CVE-2020-6463

Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR (CVE-2020-6514).

Crafted media files could lead to a race in texture caches, resulting in a use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture, memory corruption, and a potentially exploitable crash (CVE-2020-6463).

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script (CVE-2020-15652).

Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15659).

Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-6829).

A side channel flaw was found in the way P-384 and P-521 curses are used in generation EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12400).

Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12401).

Multi-part ChaCha20 was not functioning correctly and tag length was not strictly enforced (CVE-2020-12403).

Potential leak of redirect targets when loading scripts in a worker. (CVE-2020-15652)

WebRTC data channel leaks internal address to peer. (CVE-2020-6514)

Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture. (CVE-2020-6463)

Memory safety bugs fixed in Thunderbird 68.11. (CVE-2020-15659)

This update for chromium fixes the following issues:

Chromium was updated to 83.0.4103.97 (boo#1171910,bsc#1172496):

• CVE-2020-6463: Use after free in ANGLE (boo#1170107 boo#1171975).
• CVE-2020-6465: Use after free in reader mode. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-04-21
• CVE-2020-6466: Use after free in media. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-04-26
• CVE-2020-6467: Use after free in WebRTC. Reported by ZhanJia Song on 2020-04-06
• CVE-2020-6468: Type Confusion in V8. Reported by Chris Salls and Jake Corina of Seaside Security, Chani Jindal of Shellphish on 2020-04-30
• CVE-2020-6469: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-04-02
• CVE-2020-6470: Insufficient validation of untrusted input in clipboard. Reported by Michał Bentkowski of Securitum on 2020-03-30
• CVE-2020-6471: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-08
• CVE-2020-6472: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-25
• CVE-2020-6473: Insufficient policy enforcement in Blink. Reported by Soroush Karami and Panagiotis Ilia on 2020-02-06
• CVE-2020-6474: Use after free in Blink. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-03-07
• CVE-2020-6475: Incorrect security UI in full screen. Reported by Khalil Zhani on 2019-10-31
• CVE-2020-6476: Insufficient policy enforcement in tab strip. Reported by Alexandre Le Borgne on 2019-12-18
• CVE-2020-6477: Inappropriate implementation in installer. Reported by RACK911 Labs on 2019-03-26
• CVE-2020-6478: Inappropriate implementation in full screen. Reported by Khalil Zhani on 2019-12-24
• CVE-2020-6479: Inappropriate implementation in sharing. Reported by Zhong Zhaochen of andsecurity.cn on 2020-01-14
• CVE-2020-6480: Insufficient policy enforcement in enterprise. Reported by Marvin Witt on 2020-02-21
• CVE-2020-6481: Insufficient policy enforcement in URL formatting. Reported by Rayyan Bijoora on 2020-04-07
• CVE-2020-6482: Insufficient policy enforcement in developer tools. Reported by Abdulrahman Alqabandi (@qab) on 2017-12-17
• CVE-2020-6483: Insufficient policy enforcement in payments. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-05-23
• CVE-2020-6484: Insufficient data validation in ChromeDriver. Reported by Artem Zinenko on 2020-01-26
• CVE-2020-6485: Insufficient data validation in media router. Reported by Sergei Glazunov of Google Project Zero on 2020-01-30
• CVE-2020-6486: Insufficient policy enforcement in navigations. Reported by David Erceg on 2020-02-24
• CVE-2020-6487: Insufficient policy enforcement in downloads. Reported by Jun Kokatsu (@shhnjk) on 2015-10-06
• CVE-2020-6488: Insufficient policy enforcement in downloads. Reported by David Erceg on 2020-01-21
• CVE-2020-6489: Inappropriate implementation in developer tools. Reported by @lovasoa (Ophir LOJKINE) on 2020-02-10
• CVE-2020-6490: Insufficient data validation in loader. Reported by Twitter on 2019-12-19
• CVE-2020-6491: Incorrect security UI in site information. Reported by Sultan Haikal M.A on 2020-02-07
• CVE-2020-6493: Use after free in WebAuthentication.
• CVE-2020-6494: Incorrect security UI in payments.
• CVE-2020-6495: Insufficient policy enforcement in developer tools.
• CVE-2020-6496: Use after free in payments.

This update for chromium fixes the following issues:

Chromium was updated to 83.0.4103.97 (boo#1171910,bsc#1172496):

• CVE-2020-6463: Use after free in ANGLE (boo#1170107 boo#1171975).
• CVE-2020-6465: Use after free in reader mode. Reported by Woojin Oh(@pwn_expoit) of STEALIEN on 2020-04-21
• CVE-2020-6466: Use after free in media. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-04-26
• CVE-2020-6467: Use after free in WebRTC. Reported by ZhanJia Song on 2020-04-06
• CVE-2020-6468: Type Confusion in V8. Reported by Chris Salls and Jake Corina of Seaside Security, Chani Jindal of Shellphish on 2020-04-30
• CVE-2020-6469: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-04-02
• CVE-2020-6470: Insufficient validation of untrusted input in clipboard. Reported by Michał Bentkowski of Securitum on 2020-03-30
• CVE-2020-6471: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-08
• CVE-2020-6472: Insufficient policy enforcement in developer tools. Reported by David Erceg on 2020-03-25
• CVE-2020-6473: Insufficient policy enforcement in Blink. Reported by Soroush Karami and Panagiotis Ilia on 2020-02-06
• CVE-2020-6474: Use after free in Blink. Reported by Zhe Jin from cdsrc of Qihoo 360 on 2020-03-07
• CVE-2020-6475: Incorrect security UI in full screen. Reported by Khalil Zhani on 2019-10-31
• CVE-2020-6476: Insufficient policy enforcement in tab strip. Reported by Alexandre Le Borgne on 2019-12-18
• CVE-2020-6477: Inappropriate implementation in installer. Reported by RACK911 Labs on 2019-03-26
• CVE-2020-6478: Inappropriate implementation in full screen. Reported by Khalil Zhani on 2019-12-24
• CVE-2020-6479: Inappropriate implementation in sharing. Reported by Zhong Zhaochen of andsecurity.cn on 2020-01-14
• CVE-2020-6480: Insufficient policy enforcement in enterprise. Reported by Marvin Witt on 2020-02-21
• CVE-2020-6481: Insufficient policy enforcement in URL formatting. Reported by Rayyan Bijoora on 2020-04-07
• CVE-2020-6482: Insufficient policy enforcement in developer tools. Reported by Abdulrahman Alqabandi (@qab) on 2017-12-17
• CVE-2020-6483: Insufficient policy enforcement in payments. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-05-23
• CVE-2020-6484: Insufficient data validation in ChromeDriver. Reported by Artem Zinenko on 2020-01-26
• CVE-2020-6485: Insufficient data validation in media router. Reported by Sergei Glazunov of Google Project Zero on 2020-01-30
• CVE-2020-6486: Insufficient policy enforcement in navigations. Reported by David Erceg on 2020-02-24
• CVE-2020-6487: Insufficient policy enforcement in downloads. Reported by Jun Kokatsu (@shhnjk) on 2015-10-06
• CVE-2020-6488: Insufficient policy enforcement in downloads. Reported by David Erceg on 2020-01-21
• CVE-2020-6489: Inappropriate implementation in developer tools. Reported by @lovasoa (Ophir LOJKINE) on 2020-02-10
• CVE-2020-6490: Insufficient data validation in loader. Reported by Twitter on 2019-12-19
• CVE-2020-6491: Incorrect security UI in site information. Reported by Sultan Haikal M.A on 2020-02-07
• CVE-2020-6493: Use after free in WebAuthentication.
• CVE-2020-6494: Incorrect security UI in payments.
• CVE-2020-6495: Insufficient policy enforcement in developer tools.
• CVE-2020-6496: Use after free in payments.

This update was imported from the openSUSE:Leap:15.1:Update update project.

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

• Updated to Mozilla Thunderbird 68.11:
  • Fixed various security issues (MFSA-2020-35, bsc#1174538).
  • Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
  • Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
  • Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
  • Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
  • Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues:

This update for MozillaFirefox and pipewire fixes the following issues:

MozillaFirefox Extended Support Release 78.1.0 ESR

• Fixed: Various stability, functionality, and security fixes (bsc#1174538)
• CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
• CVE-2020-6514: WebRTC data channel leaks internal address to peer
• CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
• CVE-2020-15653: Bypassing iframe sandbox when allowing popups
• CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
• CVE-2020-15656: Type confusion for special arguments in IonMonkey
• CVE-2020-15658: Overriding file type when saving to disk
• CVE-2020-15657: DLL hijacking due to incorrect loading path
• CVE-2020-15654: Custom cursor can overlay user interface
• CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308):

• Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed.
• Compile fixes
• Stability improvements in jack and pulseaudio layers.
• Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions.
• Improvements to the GStreamer source and sink shutdown.
• Fix compatibility with v2 clients again when negotiating buffers.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for MozillaThunderbird fixes the following issues:

• Updated to Mozilla Thunderbird 68.11:
  • Fixed various security issues (MFSA-2020-35, bsc#1174538).
  • Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
  • Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
  • Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
  • Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
  • Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

• Fix broken translation-loading (boo#1173991)

  • allow addon sideloading
  • mark signatures for langpacks non-mandatory
  • do not autodisable user profile scopes

• Google API key is not usable for geolocation service any more

• Mozilla Firefox 78.1 ESR

  • Fixed: Various stability, functionality, and security fixe (MFSA 2020-32) (bsc#1174538).
  • CVE-2020-15652 (bmo#1634872) Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514 (bmo#1642792) WebRTC data channel leaks internal address to peer
  • CVE-2020-15655 (bmo#1645204) Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653 (bmo#1521542) Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463 (bmo#1635293) Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656 (bmo#1647293) Type confusion for special arguments in IonMonkey
  • CVE-2020-15658 (bmo#1637745) Overriding file type when saving to disk
  • CVE-2020-15657 (bmo#1644954) DLL hijacking due to incorrect loading path
  • CVE-2020-15654 (bmo#1648333) Custom cursor can overlay user interface
  • CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1643613, bmo#1644839, bmo#1645835, bmo#1646006, bmo#1646787, bmo#1649347, bmo#1650811, bmo#1651678) Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

• Add sle11-icu-generation-python3.patch to fix icu-generation on big endian platforms

• Mozilla Firefox 78.0.2 ESR

  • MFSA 2020-28 (bsc#1173948)
  • MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or embed tags
  • Fixed: Fixed an accessibility regression in reader mode (bmo#1650922)
  • Fixed: Made the address bar more resilient to data corruption in the user profile (bmo#1649981)
  • Fixed: Fixed a regression opening certain external applications (bmo#1650162)

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update for MozillaFirefox fixes the following issues:

This update for MozillaFirefox and pipewire fixes the following issues:

MozillaFirefox Extended Support Release 78.1.0 ESR

• Fixed: Various stability, functionality, and security fixes (bsc#1174538)
• CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
• CVE-2020-6514: WebRTC data channel leaks internal address to peer
• CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
• CVE-2020-15653: Bypassing iframe sandbox when allowing popups
• CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
• CVE-2020-15656: Type confusion for special arguments in IonMonkey
• CVE-2020-15658: Overriding file type when saving to disk
• CVE-2020-15657: DLL hijacking due to incorrect loading path
• CVE-2020-15654: Custom cursor can overlay user interface
• CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308):

• Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed.
• Compile fixes
• Stability improvements in jack and pulseaudio layers.
• Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions.
• Improvements to the GStreamer source and sink shutdown.
• Fix compatibility with v2 clients again when negotiating buffers.

This update for MozillaThunderbird fixes the following issues:

• Updated to Mozilla Thunderbird 68.11:
  • Fixed various security issues (MFSA-2020-35, bsc#1174538).
  • Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
  • Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
  • Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
  • Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
  • Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118).

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass iframe sandbox restrictions, confuse the user, or execute arbitrary code. (CVE-2020-6463, CVE-2020-6514, CVE-2020-15652, CVE-2020-15653, CVE-2020-15654, CVE-2020-15656, CVE-2020-15658, CVE-2020-15659)

It was discovered that redirected HTTP requests which are observed or modified through a web extension could bypass existing CORS checks. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit this to obtain sensitive information across origins. (CVE-2020-15655)