Mozilla Foundation Security Advisory 2020-31
Security Vulnerabilities fixed in Firefox ESR 68.11
- Announced
- July 28, 2020
- Impact
- high
- Products
- Firefox ESR
- Fixed in
-
- Firefox ESR 68.11
#CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
- Reporter
- Mikhail Oblozhikhin
- Impact
- high
Description
By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script.
References
#CVE-2020-6514: WebRTC data channel leaks internal address to peer
- Reporter
- Natalie Silvanovich of Google Project Zero
- Impact
- high
Description
WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR.
References
#CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
- Reporter
- Reported by Pawel Wylecial of REDTEAM.PL
- Impact
- moderate
Description
Crafted media files could lead to a race in texture caches, resulting in a use-after-free, memory corruption, and a potentially exploitable crash.
References
#CVE-2020-15650: Overwriting local files through malicious file picker application
- Reporter
- Pedro Oliveira
- Impact
- moderate
Description
Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile).
Note: This issue only affected Firefox for Android. Other operating systems are unaffected.
References
#CVE-2020-15649: Exfiltrating local files through malicious file picker application
- Reporter
- Andrea Palazzo, Pedro Oliveira
- Impact
- moderate
Description
Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked.
Note: This issue only affected Firefox for Android. Other operating systems are unaffected.
References
#CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 68.11
- Reporter
- Mozilla developers
- Impact
- high
Description
Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.