Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, bypass permission prompts, or execute arbitrary code.
(CVE-2020-12415, CVE-2020-12416, CVE-2020-12417, CVE-2020-12418,
CVE-2020-12419, CVE-2020-12420, CVE-2020-12422, CVE-2020-12424,
CVE-2020-12425, CVE-2020-12426)
It was discovered that when performing add-on updates, certificate chains
not terminating with built-in roots were silently rejected. This could
result in add-ons becoming outdated. (CVE-2020-12421)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 78.0.1+build1-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 78.0.1+build1-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 78.0.1+build1-0ubuntu0.20.04.1 |
Vulnerabilities 11
-
Unscored —
When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest t…
-
Unscored —
A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use…
-
Unscored —
Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memor…
-
Unscored —
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malici…
-
Unscored —
When processing callbacks that occurred during window flushing in the parent process, the associated window may die; ca…
-
Unscored —
When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to m…
-
Unscored —
When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were l…
-
Unscored —
In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, …
-
Unscored —
When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, …
-
Unscored —
Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, lead…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 77. Some of these bugs showed e…
References
-
report
https://ubuntu.com/security/CVE-2020-12415
-
report
https://ubuntu.com/security/CVE-2020-12416
-
report
https://ubuntu.com/security/CVE-2020-12417
-
report
https://ubuntu.com/security/CVE-2020-12418
-
report
https://ubuntu.com/security/CVE-2020-12419
-
report
https://ubuntu.com/security/CVE-2020-12420
-
report
https://ubuntu.com/security/CVE-2020-12421
-
report
https://ubuntu.com/security/CVE-2020-12422
-
report
https://ubuntu.com/security/CVE-2020-12424
-
report
https://ubuntu.com/security/CVE-2020-12425
-
report
https://ubuntu.com/security/CVE-2020-12426