CVE-2020-15652

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR (CVE-2020-6514).

Crafted media files could lead to a race in texture caches, resulting in a use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture, memory corruption, and a potentially exploitable crash (CVE-2020-6463).

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script (CVE-2020-15652).

Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15659).

Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-6829).

A side channel flaw was found in the way P-384 and P-521 curses are used in generation EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12400).

Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12401).

Multi-part ChaCha20 was not functioning correctly and tag length was not strictly enforced (CVE-2020-12403).

Potential leak of redirect targets when loading scripts in a worker. (CVE-2020-15652)

WebRTC data channel leaks internal address to peer. (CVE-2020-6514)

Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture. (CVE-2020-6463)

Memory safety bugs fixed in Thunderbird 68.11. (CVE-2020-15659)

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

• Updated to Mozilla Thunderbird 68.11:
  • Fixed various security issues (MFSA-2020-35, bsc#1174538).
  • Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
  • Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
  • Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
  • Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
  • Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox fixes the following issues:

This update for MozillaFirefox and pipewire fixes the following issues:

MozillaFirefox Extended Support Release 78.1.0 ESR

• Fixed: Various stability, functionality, and security fixes (bsc#1174538)
• CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
• CVE-2020-6514: WebRTC data channel leaks internal address to peer
• CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
• CVE-2020-15653: Bypassing iframe sandbox when allowing popups
• CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
• CVE-2020-15656: Type confusion for special arguments in IonMonkey
• CVE-2020-15658: Overriding file type when saving to disk
• CVE-2020-15657: DLL hijacking due to incorrect loading path
• CVE-2020-15654: Custom cursor can overlay user interface
• CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308):

• Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed.
• Compile fixes
• Stability improvements in jack and pulseaudio layers.
• Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions.
• Improvements to the GStreamer source and sink shutdown.
• Fix compatibility with v2 clients again when negotiating buffers.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for MozillaThunderbird fixes the following issues:

• Updated to Mozilla Thunderbird 68.11:
  • Fixed various security issues (MFSA-2020-35, bsc#1174538).
  • Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
  • Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
  • Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
  • Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
  • Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

• Fix broken translation-loading (boo#1173991)

  • allow addon sideloading
  • mark signatures for langpacks non-mandatory
  • do not autodisable user profile scopes

• Google API key is not usable for geolocation service any more

• Mozilla Firefox 78.1 ESR

  • Fixed: Various stability, functionality, and security fixe (MFSA 2020-32) (bsc#1174538).
  • CVE-2020-15652 (bmo#1634872) Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514 (bmo#1642792) WebRTC data channel leaks internal address to peer
  • CVE-2020-15655 (bmo#1645204) Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653 (bmo#1521542) Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463 (bmo#1635293) Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656 (bmo#1647293) Type confusion for special arguments in IonMonkey
  • CVE-2020-15658 (bmo#1637745) Overriding file type when saving to disk
  • CVE-2020-15657 (bmo#1644954) DLL hijacking due to incorrect loading path
  • CVE-2020-15654 (bmo#1648333) Custom cursor can overlay user interface
  • CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1643613, bmo#1644839, bmo#1645835, bmo#1646006, bmo#1646787, bmo#1649347, bmo#1650811, bmo#1651678) Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

• Add sle11-icu-generation-python3.patch to fix icu-generation on big endian platforms

• Mozilla Firefox 78.0.2 ESR

  • MFSA 2020-28 (bsc#1173948)
  • MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or embed tags
  • Fixed: Fixed an accessibility regression in reader mode (bmo#1650922)
  • Fixed: Made the address bar more resilient to data corruption in the user profile (bmo#1649981)
  • Fixed: Fixed a regression opening certain external applications (bmo#1650162)

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update for MozillaFirefox fixes the following issues:

• Firefox Extended Support Release 78.1.0 ESR
  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update for MozillaFirefox fixes the following issues:

This update for MozillaFirefox and pipewire fixes the following issues:

MozillaFirefox Extended Support Release 78.1.0 ESR

• Fixed: Various stability, functionality, and security fixes (bsc#1174538)
• CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
• CVE-2020-6514: WebRTC data channel leaks internal address to peer
• CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
• CVE-2020-15653: Bypassing iframe sandbox when allowing popups
• CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
• CVE-2020-15656: Type confusion for special arguments in IonMonkey
• CVE-2020-15658: Overriding file type when saving to disk
• CVE-2020-15657: DLL hijacking due to incorrect loading path
• CVE-2020-15654: Custom cursor can overlay user interface
• CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308):

• Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed.
• Compile fixes
• Stability improvements in jack and pulseaudio layers.
• Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions.
• Improvements to the GStreamer source and sink shutdown.
• Fix compatibility with v2 clients again when negotiating buffers.

This update for MozillaThunderbird fixes the following issues:

• Updated to Mozilla Thunderbird 68.11:
  • Fixed various security issues (MFSA-2020-35, bsc#1174538).
  • Fixed CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker (bsc#1174538).
  • Fixed CVE-2020-6514: WebRTC data channel leaks internal address to peer (bsc#1174538).
  • Fixed CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture (bsc#1174538).
  • Fixed CVE-2020-15659: Memory safety bugs fixed in Thunderbird 68.11 (bsc#1174538).
  • Fixed a bug with FileLink attachments included as a link and file when added from a network drive via drag & drop (bmo#793118).

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass iframe sandbox restrictions, confuse the user, or execute arbitrary code. (CVE-2020-6463, CVE-2020-6514, CVE-2020-15652, CVE-2020-15653, CVE-2020-15654, CVE-2020-15656, CVE-2020-15658, CVE-2020-15659)

It was discovered that redirected HTTP requests which are observed or modified through a web extension could bypass existing CORS checks. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit this to obtain sensitive information across origins. (CVE-2020-15655)