CVE-2020-6819

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Updated firefox packages fix security vulnerabilities:

Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free (CVE-2020-6819).

Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free (CVE-2020-6820).

The updated packages fix security vulnerabilities:

Use-after-free while running the nsDocShell destructor. (CVE-2020-6819)

Use-after-free when handling a ReadableStream. (CVE-2020-6820)

Uninitialized memory could be read when using the WebGL copyTexSubImage method. (CVE-2020-6821)

Out of bounds write in GMPDecodeData when processing large images. (CVE-2020-6822)

Memory safety bugs fixed in Thunderbird 68.7.0. (CVE-2020-6825)

Mozilla Firefox was updated to 68.6.1esr to fix critical security issues:

MFSA 2020-11 (boo#1168630)

• CVE-2020-6819: Use-after-free while running the nsDocShell destructor
• CVE-2020-6820: Use-after-free when handling a ReadableStream

This update for MozillaThunderbird to version 68.7.0 fixes the following issues:

• CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630)
• CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630)
• CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874)
• CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874)
• CVE-2020-6825: Memory safety bugs fixed (boo#1168874)

This update for MozillaThunderbird to version 68.7.0 fixes the following issues:

• CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630)
• CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630)
• CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874)
• CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874)
• CVE-2020-6825: Memory safety bugs fixed (boo#1168874)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

• Mozilla Firefox 68.6.1esr MFSA 2020-11 (bsc#1168630)
  • CVE-2020-6819 (bmo#1620818) Use-after-free while running the nsDocShell destructor
  • CVE-2020-6820 (bmo#1626728) Use-after-free when handling a ReadableStream

This update for MozillaFirefox fixes the following issues:

• Mozilla Firefox 68.6.1esr MFSA 2020-11 (bsc#1168630)
  • CVE-2020-6819 (bmo#1620818) Use-after-free while running the nsDocShell destructor
  • CVE-2020-6820 (bmo#1626728) Use-after-free when handling a ReadableStream

This update for MozillaThunderbird to version 68.7.0 fixes the following issues:

• CVE-2020-6819: Use-after-free while running the nsDocShell destructor (boo#1168630)
• CVE-2020-6820: Use-after-free when handling a ReadableStream (boo#1168630)
• CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage() (boo#1168874)
• CVE-2020-6822: Out of bounds write in GMPDecodeData when processing large images (boo#1168874)
• CVE-2020-6825: Memory safety bugs fixed (boo#1168874)

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 68.6.1 ESR MFSA 2020-11 (bsc#1168630)
  • CVE-2020-6819 (bmo#1620818) Use-after-free while running the nsDocShell destructor
  • CVE-2020-6820 (bmo#1626728) Use-after-free when handling a ReadableStream

Two use-after-free bugs were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit these to cause a denial of service or execute arbitrary code.

It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792)

Mutiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795, CVE-2020-6822)

It was discovered that if a user saved passwords before Thunderbird 60 and then later set a master password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2020-6794)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct cross-site scripting (XSS) attacks, obtain sensitive information, or execute arbitrary code. (CVE-2019-20503, CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)

It was discovered that the Devtools’ ‘Copy as cURL’ feature did not fully escape website-controlled data. If a user were tricked in to using the ‘Copy as cURL’ feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection. (CVE-2020-6811)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503, CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-11745)

It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some circumstances, even if the signer had no access to the encrypted message. An attacker could potentially exploit this to spoof the message author. (CVE-2019-11755)

A heap overflow was discovered in the expat library in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-15903)

It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792)

Mutiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795, CVE-2020-6822)

It was discovered that if a user saved passwords before Thunderbird 60 and then later set a primary password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2020-6794)

It was discovered that the Devtools’ ‘Copy as cURL’ feature did not fully escape website-controlled data. If a user were tricked in to using the ‘Copy as cURL’ feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection. (CVE-2020-6811)