Bugzilla – Bug 1174538
VUL-0: CVE-2020-15652: MozillaFirefox,MozillaThunderbird: Update to 79/78.1ESR
Last modified: 2022-09-06 16:43:49 UTC
https://ftp.mozilla.org/pub/firefox/releases/79.0/ Release notes pending.
Firefox ESR 78.1ESR and Firefox 79 and Thunderbird 79 CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker CVE-2020-6514: WebRTC data channel leaks internal address to peer CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy CVE-2020-15653: Bypassing iframe sandbox when allowing popups CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture CVE-2020-15656: Type confusion for special arguments in IonMonkey CVE-2020-15658: Overriding file type when saving to disk CVE-2020-15657: DLL hijacking due to incorrect loading path CVE-2020-15654: Custom cursor can overlay user interface CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1
These are: MFSA 2020-33 Security Vulnerabilities fixed in Thunderbird 78.1 MFSA 2020-32 Security Vulnerabilities fixed in Firefox ESR 78.1 MFSA 2020-30 Security Vulnerabilities fixed in Firefox 79 Reference https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-32/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-30/
This is an autogenerated message for OBS integration: This bug (1174538) was mentioned in https://build.opensuse.org/request/show/823315 Factory / MozillaFirefox
MozillaThunderbird 68.11 MFSA 2020-35 * CVE-2020-15652 (bmo#1634872) Potential leak of redirect targets when loading scripts in a worker * CVE-2020-6514 (bmo#1642792) WebRTC data channel leaks internal address to peer * CVE-2020-6463 (bmo#1635293) Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787, bmo#1650811) Memory safety bugs fixed in Thunderbird 68.11 (We are not yet updating to the Thunderbird 78 branch, until 78.2, due to non-functioning enigmail)
SUSE-SU-2020:2100-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 1173948,1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): MozillaFirefox-78.1.0-112.8.1 SUSE OpenStack Cloud Crowbar 8 (src): MozillaFirefox-78.1.0-112.8.1 SUSE OpenStack Cloud 9 (src): MozillaFirefox-78.1.0-112.8.1 SUSE OpenStack Cloud 8 (src): MozillaFirefox-78.1.0-112.8.1 SUSE OpenStack Cloud 7 (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server 12-SP5 (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): MozillaFirefox-78.1.0-112.8.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): MozillaFirefox-78.1.0-112.8.1 SUSE Enterprise Storage 5 (src): MozillaFirefox-78.1.0-112.8.1 HPE Helion Openstack 8 (src): MozillaFirefox-78.1.0-112.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
(In reply to Alexandros Toptsoglou from comment #2) > MFSA 2020-33 Security Vulnerabilities fixed in Thunderbird 78.1 I think you'll actually want to go to 68.11.0 first before doing the jump to the next ESR... https://www.mozilla.org/en-US/security/advisories/mfsa2020-35/ https://www.thunderbird.net/en-US/thunderbird/68.11.0/releasenotes/
https://build.opensuse.org/request/show/823876 > - Mozilla Thunderbird 68.11.0 > * fixed: FileLink attachments included as a link and file when > added from a network drive via drag & drop (bmo#793118) > MFSA 2020-35 (bsc#1174538) > * CVE-2020-15652 (bmo#1634872) > Potential leak of redirect targets when loading scripts in a > worker > * CVE-2020-6514 (bmo#1642792) > WebRTC data channel leaks internal address to peer > * CVE-2020-6463 (bmo#1635293) > Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture > * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787, > bmo#1650811) > Memory safety bugs fixed in Thunderbird 68.11
(In reply to Andreas Stieger from comment #9) > (In reply to Alexandros Toptsoglou from comment #2) > > MFSA 2020-33 Security Vulnerabilities fixed in Thunderbird 78.1 > > I think you'll actually want to go to 68.11.0 first before doing the jump to > the next ESR... > > https://www.mozilla.org/en-US/security/advisories/mfsa2020-35/ > https://www.thunderbird.net/en-US/thunderbird/68.11.0/releasenotes/ Yes indeed, that is what will happen
SUSE-SU-2020:2118-1: An update that fixes 10 vulnerabilities is now available. Category: security (important) Bug References: 1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src): MozillaFirefox-78.1.0-3.100.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1147-1: An update that fixes 10 vulnerabilities is now available. Category: security (important) Bug References: 1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: openSUSE Leap 15.1 (src): MozillaFirefox-78.1.0-lp151.2.61.1
SUSE-SU-2020:2147-1: An update that fixes 10 vulnerabilities is now available. Category: security (important) Bug References: 1171433,1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: ECO-2308 Sources used: SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src): MozillaFirefox-78.1.0-8.3.1, MozillaFirefox-branding-SLE-78-9.2.4, pipewire-0.3.6-3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1155-1: An update that fixes 10 vulnerabilities is now available. Category: security (important) Bug References: 1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: openSUSE Leap 15.2 (src): MozillaFirefox-78.1.0-lp152.2.12.1
SUSE-SU-2020:2179-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1174538 CVE References: CVE-2020-15652,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: SUSE Linux Enterprise Workstation Extension 15-SP2 (src): MozillaThunderbird-68.11.0-3.91.1 SUSE Linux Enterprise Workstation Extension 15-SP1 (src): MozillaThunderbird-68.11.0-3.91.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1179-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1174538 CVE References: CVE-2020-15652,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: openSUSE Leap 15.1 (src): MozillaThunderbird-68.11.0-lp151.2.47.1
openSUSE-SU-2020:1189-1: An update that fixes 10 vulnerabilities is now available. Category: security (important) Bug References: 1171433,1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: openSUSE Leap 15.2 (src): MozillaFirefox-78.1.0-lp152.2.15.1, pipewire-0.3.6-lp152.2.3.1
openSUSE-SU-2020:1205-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 1174538 CVE References: CVE-2020-15652,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: openSUSE Leap 15.2 (src): MozillaThunderbird-68.11.0-lp152.2.7.1
SUSE-SU-2020:14456-1: An update that fixes 10 vulnerabilities is now available. Category: security (moderate) Bug References: 1173948,1173991,1174538 CVE References: CVE-2020-15652,CVE-2020-15653,CVE-2020-15654,CVE-2020-15655,CVE-2020-15656,CVE-2020-15657,CVE-2020-15658,CVE-2020-15659,CVE-2020-6463,CVE-2020-6514 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): MozillaFirefox-78.1.0-78.87.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): MozillaFirefox-78.1.0-78.87.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Released.
Resolved.