First Last Prev Next    This bug is not in your last search results.
Bug 1173576 - VUL-0: MozillaFirefox/MozillaThunderbird: 68.10ESR / 78.0.1 release
VUL-0: MozillaFirefox/MozillaThunderbird: 68.10ESR / 78.0.1 release
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Martin Sirringhaus
Security Team bot
https://smash.suse.de/issue/262677/
CVSSv3.1:SUSE:CVE-2020-15646:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2020-07-01 12:50 UTC by Alexandros Toptsoglou
Modified: 2022-09-06 16:43 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2020-07-01 12:50:51 UTC 
According the changelog no security fixes are included

https://www.mozilla.org/en-US/firefox/68.10.0/releasenotes/
https://www.mozilla.org/en-US/firefox/78.0/releasenotes/
Comment 1 Martin Sirringhaus 2020-07-01 12:57:23 UTC 
Seems like they found a last-minute bug and are pushing for a 78.0.1 and 68.10.1 release, before disclosing the fixed MFSAs
Comment 2 Alexandros Toptsoglou 2020-07-01 16:28:40 UTC 
UPDATE: 

Fixes in 68.10
CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64
CVE-2020-12418: Information disclosure due to manipulated URL object
CVE-2020-12419: Use-after-free in nsGlobalWindowInner
CVE-2020-12420: Use-After-Free when trying to connect to a STUN server
CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates

Fix in 78.0.1 --> Fixed an issue which could cause installed search engines to not be visible when upgrading from a previous release.

Fixes in 78.0

CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing
CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster
CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64
CVE-2020-12418: Information disclosure due to manipulated URL object
CVE-2020-12419: Use-after-free in nsGlobalWindowInner
CVE-2020-12420: Use-After-Free when trying to connect to a STUN server
CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack
CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates
CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer
CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library
CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process
CVE-2020-12425: Out of bound read in Date.parse()
CVE-2020-12426: Memory safety bugs fixed in Firefox 78
Comment 4 Martin Sirringhaus 2020-07-03 07:45:00 UTC 
- Mozilla Thunderbird 68.10.0
  MFSA 2020-26
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
    (Note: This issue is pending a CVE assignment and will be updated when one is available.)
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates
Comment 6 OBSbugzilla Bot 2020-07-03 20:50:11 UTC 
This is an autogenerated message for OBS integration:
This bug (1173576) was mentioned in
https://build.opensuse.org/request/show/818643 Factory / MozillaFirefox
Comment 7 Swamp Workflow Management 2020-07-08 13:16:11 UTC 
SUSE-SU-2020:14421-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1166238,1167231,1173576
CVE References: CVE-2020-12402,CVE-2020-12415,CVE-2020-12416,CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421,CVE-2020-12422,CVE-2020-12423,CVE-2020-12424,CVE-2020-12425,CVE-2020-12426
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    MozillaFirefox-78.0.1-78.80.2, MozillaFirefox-branding-SLED-78-21.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-07-13 16:13:36 UTC 
SUSE-SU-2020:1899-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1167231,1173576,1173613
CVE References: CVE-2020-12402,CVE-2020-12415,CVE-2020-12416,CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421,CVE-2020-12422,CVE-2020-12423,CVE-2020-12424,CVE-2020-12425,CVE-2020-12426
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE OpenStack Cloud Crowbar 8 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE OpenStack Cloud 9 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE OpenStack Cloud 8 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE OpenStack Cloud 7 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    MozillaFirefox-78.0.1-112.3.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server 12-SP5 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
SUSE Enterprise Storage 5 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1
HPE Helion Openstack 8 (src):    MozillaFirefox-78.0.1-112.3.1, MozillaFirefox-branding-SLE-78-35.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2020-07-13 16:14:22 UTC 
SUSE-SU-2020:1900-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1173576
CVE References: CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421
Sources used:
SUSE Linux Enterprise Workstation Extension 15-SP2 (src):    MozillaThunderbird-68.10.0-3.88.1
SUSE Linux Enterprise Workstation Extension 15-SP1 (src):    MozillaThunderbird-68.10.0-3.88.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-07-13 16:15:11 UTC 
SUSE-SU-2020:1898-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1166238,1173576,1173613
CVE References: CVE-2020-12402,CVE-2020-12415,CVE-2020-12416,CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421,CVE-2020-12422,CVE-2020-12423,CVE-2020-12424,CVE-2020-12425,CVE-2020-12426
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15-SP2 (src):    MozillaFirefox-78.0.1-3.94.2, MozillaFirefox-branding-SLE-78-4.14.1
SUSE Linux Enterprise Module for Desktop Applications 15-SP1 (src):    MozillaFirefox-78.0.1-3.94.2, MozillaFirefox-branding-SLE-78-4.14.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2020-07-15 16:21:12 UTC 
openSUSE-SU-2020:0967-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1173576
CVE References: CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421
Sources used:
openSUSE Leap 15.1 (src):    MozillaThunderbird-68.10.0-lp151.2.44.2
Comment 13 Swamp Workflow Management 2020-07-17 22:14:06 UTC 
openSUSE-SU-2020:0982-1: An update that fixes 5 vulnerabilities is now available.

Category: security (important)
Bug References: 1173576
CVE References: CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421
Sources used:
openSUSE Leap 15.2 (src):    MozillaThunderbird-68.10.0-lp152.2.4.1
Comment 14 Swamp Workflow Management 2020-07-17 22:15:03 UTC 
openSUSE-SU-2020:0983-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1166238,1173576,1173613
CVE References: CVE-2020-12402,CVE-2020-12415,CVE-2020-12416,CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421,CVE-2020-12422,CVE-2020-12423,CVE-2020-12424,CVE-2020-12425,CVE-2020-12426
Sources used:
openSUSE Leap 15.2 (src):    MozillaFirefox-78.0.1-lp152.2.5.1
Comment 15 Swamp Workflow Management 2020-07-20 13:13:07 UTC 
openSUSE-SU-2020:1017-1: An update that fixes 13 vulnerabilities is now available.

Category: security (important)
Bug References: 1166238,1173576,1173613
CVE References: CVE-2020-12402,CVE-2020-12415,CVE-2020-12416,CVE-2020-12417,CVE-2020-12418,CVE-2020-12419,CVE-2020-12420,CVE-2020-12421,CVE-2020-12422,CVE-2020-12423,CVE-2020-12424,CVE-2020-12425,CVE-2020-12426
Sources used:
openSUSE Leap 15.1 (src):    MozillaFirefox-78.0.1-lp151.2.53.1
Comment 16 Marcus Meissner 2020-10-03 07:05:08 UTC 
done
First Last Prev Next    This bug is not in your last search results.