MGASA-2020-0161: firefox Mageia

CVSS: UnknownPublished

Published 05-04-2020Last modified 16-04-2026

Open JSON

Vulnerability summary

MGASA-2020-0161 is a vulnerability in firefox Mageia with no CVSS score yet.

Overall risk

0/100

0100

Minimal · default modelHow is this calculated?

CVSS score

Not scored

010

No CVSS score recorded

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 2 · Downstream 0

CVE-2020-6819 CVE-2020-6820

Timeline

05-04-2020
PublishedVulnerability first disclosed.
16-04-2026
Last modifiedVulnerability information updated.

Description

Updated firefox packages fix security vulnerabilities Updated firefox packages fix security vulnerabilities: Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free (CVE-2020-6819). Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free (CVE-2020-6820).

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Mageia2 products

firefox< 68.6.1-1.mga7
firefox-l10n< 68.6.1-1.mga7

1 vendor · 2 products

References

3 links

advisories.mageia.org/MGASA-2020-0161.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=26433REPORT
www.mozilla.org/en-US/security/advisories/mfsa2020-11/Advisory

Related vulnerabilities

MGASA-2021-0199mageiafirefox+55y ago29-04-2021 09:41Updated firefox packages fix security vulnerabilities More internal network hosts could have been probed by a malicious webpage: Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine (CVE-2021-23961). Out of bound write due to lazy initialization: A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out of bound write (CVE-2021-23994). Use-after-free in Responsive Design Mode: When Responsive Design Mode was enabled, it used references to objects that were previously freed. We presume that with enough effort this could have been exploited to run arbitrary code (CVE-2021-23995). Secure Lock icon could have been spoofed: Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page (CVE-2021-23998). Blob URLs may have been granted additional privileges: If a Blob URL was loaded through some unusual user interaction, it could have been loaded by the System Principal and granted additional privileges that should not be granted to web content (CVE-2021-23999). Arbitrary FTP command execution on FTP servers using an encoded URL: When a user clicked on an FTP URL containing encoded newline characters (%0A and %0D), the newlines would have been interpreted as such and allowed arbitrary commands to be sent to the FTP server (CVE-2021-24002). Incorrect size computation in WebAssembly JIT could lead to null-reads: The WebAssembly JIT could miscalculate the size of a return type, which could lead to a null read and result in a crash. Note: This issue only affected x86-32 platforms. Other platforms are unaffected. (CVE-2021-29945). Port blocking could be bypassed: Ports that were written as an integer overflow above the bounds of a 16-bit integer could have bypassed port blocking restrictions when used in the Alt-Svc header (CVE-2021-29946).MGASA-2021-0163mageiafirefox+75y ago30-03-2021 20:08Updated firefox packages fix security vulnerabilities Texture upload into an unbound backing buffer resulted in an out-of-bound read. (CVE-2021-23981) Angle graphics library out of date. (CVE-2021-4127) Internal network hosts could have been probed by a malicious webpage. (CVE-2021-23982) Malicious extensions could have spoofed popup information. (CVE-2021-23984) Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9 (CVE-2021-23987).MGASA-2021-0097mageiafirefox+75y ago04-03-2021 12:26Updated firefox packages fix security vulnerabilities If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs (CVE-2021-23968). As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage." Under certain types of redirects, Firefox incorrectly set the source file to be the destination of the redirects. This was fixed to be the redirect destination's origin (CVE-2021-23969). When trying to load a cross-origin resource in an audio/video context a decoding error may have resulted, and the content of that MediaError message may have revealed information about the resource (CVE-2021-23973). Mozilla developers Alexis Beingessner, Tyson Smith, Nika Layzell, and Mats Palmgren reported memory safety bugs present in Firefox ESR 78.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2021-23978).MGASA-2021-0065mageiacrypto-policies+35y ago04-02-2021 13:40Updated firefox packages fix security vulnerabilities When a HTTPS page was embedded in a HTTP page, and there was a service worker registered for the former, the service worker could have intercepted the request for the secure page despite the iframe not being a secure context due to the (insecure) framing (CVE-2020-26976). If a user clicked into a specifically crafted PDF, the PDF reader could be confused into leaking cross-origin information, when said information is served as chunked data (CVE-2021-23953). Using the new logical assignment operators in a JavaScript switch statement could have caused a type confusion, leading to a memory corruption and a potentially exploitable crash (CVE-2021-23954). Performing garbage collection on re-declared JavaScript variables resulted in a user-after-poison, and a potentially exploitable crash (CVE-2021-23960). Mozilla developers Alexis Beingessner, Christian Holler, Andrew McCreight, Tyson Smith, Jon Coppeard, André Bargull, Jason Kratzer, Jesse Schwartzentruber, Steve Fink, Byron Campen reported memory safety bugs present in Firefox ESR 78.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2021-23964).MGASA-2020-0461mageiafirefox+25y ago17-12-2020 13:10Updated firefox packages fix security vulnerabilities When a BigInt was right-shifted the backing store was not properly cleared, allowing uninitialized memory to be read (CVE-2020-16042). Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow in WebGL on some video drivers (CVE-2020-26971). Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass (CVE-2020-26973). When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash (CVE-2020-26974). Using techniques that built on the slipstream research, a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine (CVE-2020-26978). When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback was not triggered for view-source URLs. While web content cannot navigate to such URLs, a user opening View Source could have inadvertently leaked their IP address (CVE-2020-35111). Mozilla developer Christian Holler reported memory safety bugs present in Firefox ESR 78.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-35113).MGASA-2020-0427mageiafirefox+25y ago19-11-2020 08:52Updated firefox and nss packages fix security vulnerabilities When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a variable amount of time depending on the content of the underlying image. This resulted in potential cross-origin information exposure of image content through timing side-channel attacks (CVE-2020-16012). A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer (CVE-2020-26951). It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus making it possible to attempt a phishing attack or otherwise confuse the user (CVE-2020-26953). In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS (CVE-2020-26956). Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass (CVE-2020-26958). During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free in WebRequestService, memory corruption, and a potentially exploitable crash (CVE-2020-26959). If the Compact() method was called on an nsTArray, the array could have been reallocated without updating other pointers, leading to a potential use-after-free and exploitable crash (CVE-2020-26960). When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses as these do not make sense coming from a DoH resolver. However when an IPv4 address was mapped through IPv6, these addresses were erroneously let through, leading to a potential DNS Rebinding attack (CVE-2020-26961). Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password (CVE-2020-26965). Mozilla developers Steve Fink, Jason Kratzer, Randell Jesup, Christian Holler, and Byron Campen reported memory safety bugs present in Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-26968).