Arch Linux Security Advisory ASA-202005-3 ========================================= Severity: Critical Date : 2020-05-06 CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12390 CVE-2020-12391 CVE-2020-12392 CVE-2020-12394 CVE-2020-12395 CVE-2020-12396 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1148 Summary ======= The package firefox before version 76.0-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and insufficient validation. Resolution ========== Upgrade to 76.0-1. # pacman -Syu "firefox>=76.0-1" The problems have been fixed upstream in version 76.0. Workaround ========== None. Description =========== - CVE-2020-6831 (arbitrary code execution) A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138. This could have led to memory corruption and a potentially exploitable crash. - CVE-2020-12387 (arbitrary code execution) A race condition has been found in Firefox before 76.0, when running shutdown code for Web Worker, leading to a use-after-free vulnerability. This results in a potentially exploitable crash. - CVE-2020-12390 (insufficient validation) An incorrect origin serialization of URLs with IPv6 addresses issue has been found in Firefox before 76.0, and could lead to incorrect security checks. - CVE-2020-12391 (arbitrary code execution) Documents formed using data: URLs in an object element failed to inherit the CSP of the creating context in Firefox before 76.0. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. - CVE-2020-12392 (content spoofing) The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request in Firefox before 76.0, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. - CVE-2020-12394 (content spoofing) A logic flaw has been found in the location bar implementation of Firefox before 76.0, and could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. - CVE-2020-12395 (arbitrary code execution) Several memory safety bugs has been found in Firefox before 76.0 and Firefox ESR before 68.8. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2020-12396 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 76.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker might be able to spoof content, bypass security checks and execute arbitrary code on the affected host. References ========== https://bugzilla.mozilla.org/show_bug.cgi?id=1632241 https://crbug.com/1073602 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1238... https://bugzilla.mozilla.org/show_bug.cgi?id=1545345 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1239... https://bugzilla.mozilla.org/show_bug.cgi?id=1141959 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1239... https://bugzilla.mozilla.org/show_bug.cgi?id=1457100 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1239... https://bugzilla.mozilla.org/show_bug.cgi?id=1614468 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1239... https://bugzilla.mozilla.org/show_bug.cgi?id=1628288 https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1239... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%... https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-1239... https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488%... https://security.archlinux.org/CVE-2020-6831 https://security.archlinux.org/CVE-2020-12387 https://security.archlinux.org/CVE-2020-12390 https://security.archlinux.org/CVE-2020-12391 https://security.archlinux.org/CVE-2020-12392 https://security.archlinux.org/CVE-2020-12394 https://security.archlinux.org/CVE-2020-12395 https://security.archlinux.org/CVE-2020-12396