Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across origins, bypass security restrictions, conduct phishing
attacks, conduct cross-site scripting (XSS) attacks, bypass Content
Security Policy (CSP) restrictions, conduct DNS rebinding attacks, or
execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 83.0+build2-0ubuntu0.18.04.2 |
| Ubuntu · 20.04 LTS 20.04:LTS | firefox | 83.0+build2-0ubuntu0.20.04.1 |
Vulnerabilities 15
-
Unscored —CVE-2020-16012 Public exploit
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak c…
-
Unscored —
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitizat…
-
Unscored —
Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially…
-
Unscored —
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possib…
-
Unscored —
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to …
-
Unscored —
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached throu…
-
Unscored —
During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-aft…
-
Unscored —
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointer…
-
Unscored —
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do no…
-
Unscored —
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populate…
-
Unscored —
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by i…
-
Unscored —
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…
-
Unscored —
When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into i…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corr…
References
-
report
https://ubuntu.com/security/CVE-2020-16012
-
report
https://ubuntu.com/security/CVE-2020-26951
-
report
https://ubuntu.com/security/CVE-2020-26952
-
report
https://ubuntu.com/security/CVE-2020-26953
-
report
https://ubuntu.com/security/CVE-2020-26956
-
report
https://ubuntu.com/security/CVE-2020-26958
-
report
https://ubuntu.com/security/CVE-2020-26959
-
report
https://ubuntu.com/security/CVE-2020-26960
-
report
https://ubuntu.com/security/CVE-2020-26961
-
report
https://ubuntu.com/security/CVE-2020-26962
-
report
https://ubuntu.com/security/CVE-2020-26963
-
report
https://ubuntu.com/security/CVE-2020-26965
-
report
https://ubuntu.com/security/CVE-2020-26967
-
report
https://ubuntu.com/security/CVE-2020-26968
-
report
https://ubuntu.com/security/CVE-2020-26969