Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the
addressbar, or execute arbitrary code. (CVE-2020-12405, CVE-2020-12406,
CVE-2020-12407, CVE-2020-12408, CVE-2020-12409, CVE-2020-12410,
CVE-2020-12411)
It was discovered that NSS showed timing differences when performing DSA
signatures. An attacker could potentially exploit this to obtain private
keys using a timing attack. (CVE-2020-12399)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 77.0.1+build1-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 77.0.1+build1-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 77.0.1+build1-0ubuntu0.20.04.1 |
Vulnerabilities 8
-
Unscored —
NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak privat…
-
Unscored —
When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially explo…
-
Unscored —
Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We…
-
Unscored —
Mozilla Developer Nicolas Silva found that when using WebRender, Firefox would under certain conditions leak arbitrary …
-
Unscored —
When browsing a document hosted on an IP address, an attacker could insert certain characters to flip domain and path i…
-
Unscored —
When using certain blank characters in a URL, they where incorrectly rendered as spaces instead of an encoded URL. This…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corr…
References
-
report
https://ubuntu.com/security/CVE-2020-12399
-
report
https://ubuntu.com/security/CVE-2020-12405
-
report
https://ubuntu.com/security/CVE-2020-12406
-
report
https://ubuntu.com/security/CVE-2020-12407
-
report
https://ubuntu.com/security/CVE-2020-12408
-
report
https://ubuntu.com/security/CVE-2020-12409
-
report
https://ubuntu.com/security/CVE-2020-12410
-
report
https://ubuntu.com/security/CVE-2020-12411