Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, spoof the prompt
for opening an external application, obtain sensitive information, or execute
arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 82.0+build2-0ubuntu0.18.04.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 82.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 7
-
High 8.1
Undefined Behavior in bounded Crossbeam channel
Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not act…
-
Unscored —
If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distingui…
-
Unscored —
When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could h…
-
Unscored —
When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what applicatio…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some o…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corr…
-
Unscored —
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap c…
References
-
report
https://ubuntu.com/security/CVE-2020-15254
-
report
https://ubuntu.com/security/CVE-2020-15680
-
report
https://ubuntu.com/security/CVE-2020-15681
-
report
https://ubuntu.com/security/CVE-2020-15682
-
report
https://ubuntu.com/security/CVE-2020-15683
-
report
https://ubuntu.com/security/CVE-2020-15684
-
report
https://ubuntu.com/security/CVE-2020-15969