Summary
USN-4637-1 fixed vulnerabilities in Firefox. This update provides the
corresponding updates for Ubuntu 16.04 LTS.
Original advisory details:
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across origins, bypass security restrictions, conduct phishing
attacks, conduct cross-site scripting (XSS) attacks, bypass Content
Security Policy (CSP) restrictions, conduct DNS rebinding attacks, or
execute arbitrary code.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 83.0+build2-0ubuntu0.16.04.3 |
Vulnerabilities 15
-
Unscored —CVE-2020-16012 Public exploit
Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak c…
-
Unscored —
A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitizat…
-
Unscored —
Incorrect bookkeeping of functions inlined during JIT compilation could have led to memory corruption and a potentially…
-
Unscored —
It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possib…
-
Unscored —
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to …
-
Unscored —
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached throu…
-
Unscored —
During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-aft…
-
Unscored —
If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointer…
-
Unscored —
When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do no…
-
Unscored —
Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populate…
-
Unscored —
Repeated calls to the history and location interfaces could have been used to hang the browser. This was addressed by i…
-
Unscored —
Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field…
-
Unscored —
When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into i…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed ev…
-
Unscored —
Mozilla developers reported memory safety bugs present in Firefox 82. Some of these bugs showed evidence of memory corr…
References
-
report
https://ubuntu.com/security/CVE-2020-16012
-
report
https://ubuntu.com/security/CVE-2020-26951
-
report
https://ubuntu.com/security/CVE-2020-26952
-
report
https://ubuntu.com/security/CVE-2020-26953
-
report
https://ubuntu.com/security/CVE-2020-26956
-
report
https://ubuntu.com/security/CVE-2020-26958
-
report
https://ubuntu.com/security/CVE-2020-26959
-
report
https://ubuntu.com/security/CVE-2020-26960
-
report
https://ubuntu.com/security/CVE-2020-26961
-
report
https://ubuntu.com/security/CVE-2020-26962
-
report
https://ubuntu.com/security/CVE-2020-26963
-
report
https://ubuntu.com/security/CVE-2020-26965
-
report
https://ubuntu.com/security/CVE-2020-26967
-
report
https://ubuntu.com/security/CVE-2020-26968
-
report
https://ubuntu.com/security/CVE-2020-26969