Security Fix(es) :

  - Mozilla: Use-after-free during worker shutdown     (CVE-2020-12387)

  - Mozilla: Memory safety bugs fixed in Firefox 76 and     Firefox ESR 68.8 (CVE-2020-12395)

  - usrsctp: Buffer overflow in AUTH chunk input validation     (CVE-2020-6831)

  - Mozilla: Arbitrary local file access with 'Copy as cURL'     (CVE-2020-12392)

  - Mozilla: Sender Email Address Spoofing using encoded     Unicode characters (CVE-2020-12397)

The remote host is affected by the vulnerability described in GLSA-202005-03 (Mozilla Thunderbird: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Thunderbird.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code, cause a Denial       of Service condition or spoof sender email address.
  Workaround :

    There is no known workaround at this time.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14359-1 advisory.

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76,     and Thunderbird < 68.8.0. (CVE-2020-12387)

  - The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox     escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects     Firefox ESR < 68.8 and Firefox < 76. (CVE-2020-12388, CVE-2020-12389)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. This vulnerability     affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12392)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request,     which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command     into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this     issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12393)

  - Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR     68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some     of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8,     Firefox < 76, and Thunderbird < 68.8.0. (CVE-2020-6831)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

New mozilla-firefox packages are available for Slackware 14.2 and
-current to fix security issues.

ID	Name	Product	Family	Published	Updated	Severity
136487	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20200511)	Nessus	Scientific Linux Local Security Checks	5/12/2020	3/12/2024	critical
136540	GLSA-202005-03 : Mozilla Thunderbird: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	5/13/2020	3/12/2024	critical
150555	SUSE SLES11 Security Update : MozillaFirefox (SUSE-SU-2020:14359-1)	Nessus	SuSE Local Security Checks	6/10/2021	12/26/2023	critical
136392	Slackware 14.2 / current : mozilla-firefox (SSA:2020-126-01)	Nessus	Slackware Local Security Checks	5/7/2020	3/13/2024	critical
196782	RHEL 5 : mozilla (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/13/2024	critical
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	3/10/2021	4/25/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical