Arch Linux Security Advisory ASA-202009-10 ========================================== Severity: High Date : 2020-09-23 CVE-ID : CVE-2020-15673 CVE-2020-15674 CVE-2020-15675 CVE-2020-15676 CVE-2020-15677 CVE-2020-15678 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1235 Summary ======= The package firefox before version 81.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing, cross-site scripting and denial of service. Resolution ========== Upgrade to 81.0-1. # pacman -Syu "firefox>=81.0-1" The problems have been fixed upstream in version 81.0. Workaround ========== None. Description =========== - CVE-2020-15673 (arbitrary code execution) Several memory safety issues have been found in Firefox before 81.0 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-15674 (arbitrary code execution) Several memory safety issues have been found in Firefox before 81.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-15675 (arbitrary code execution) A use-after-free issue has been found in the WebGL implementation of Firefox before 81.0 where, when processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. - CVE-2020-15676 (cross-site scripting) Firefox before 81.0 sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a content-editable element. - CVE-2020-15677 (content spoofing) An issue has been found in Firefox before 81.0 where, by exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. - CVE-2020-15678 (denial of service) A use-after-free issue has been found in Firefox before 81.0 where, when recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. Impact ====== A remote attacker might be able to cause a crash, spoof content or execute arbitrary code. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-42 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-1567... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1648493%2C1660800 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-1567... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1656063%2C1656064%2C1656067%... https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-1567... https://bugzilla.mozilla.org/show_bug.cgi?id=1654211 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-1567... https://bugzilla.mozilla.org/show_bug.cgi?id=1646140 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-1567... https://bugzilla.mozilla.org/show_bug.cgi?id=1641487 https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-1567... https://bugzilla.mozilla.org/show_bug.cgi?id=1660211 https://security.archlinux.org/CVE-2020-15673 https://security.archlinux.org/CVE-2020-15674 https://security.archlinux.org/CVE-2020-15675 https://security.archlinux.org/CVE-2020-15676 https://security.archlinux.org/CVE-2020-15677 https://security.archlinux.org/CVE-2020-15678