Security update for MozillaFirefox SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:1748-1 Final 1 1 2020-10-26T21:04:55Z current 2020-10-26T21:04:55Z 2020-10-26T21:04:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.4.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-46 (bsc#1177872, bsc#1176756) * CVE-2020-15969 Use-after-free in usersctp * CVE-2020-15683 Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 * Fixed: Fixed legacy preferences not being properly applied when set via GPO This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-1748 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CU2EYNXYAWD2VQ4FXESYJGATZGSMOZCO/ E-Mail link for openSUSE-SU-2020:1748-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1176756 SUSE Bug 1176756 https://bugzilla.suse.com/1177872 SUSE Bug 1177872 https://www.suse.com/security/cve/CVE-2020-15683/ SUSE CVE CVE-2020-15683 page https://www.suse.com/security/cve/CVE-2020-15969/ SUSE CVE CVE-2020-15969 page openSUSE Leap 15.2 MozillaFirefox-78.4.0-lp152.2.24.1 MozillaFirefox-branding-upstream-78.4.0-lp152.2.24.1 MozillaFirefox-buildsymbols-78.4.0-lp152.2.24.1 MozillaFirefox-devel-78.4.0-lp152.2.24.1 MozillaFirefox-translations-common-78.4.0-lp152.2.24.1 MozillaFirefox-translations-other-78.4.0-lp152.2.24.1 MozillaFirefox-78.4.0-lp152.2.24.1 as a component of openSUSE Leap 15.2 MozillaFirefox-branding-upstream-78.4.0-lp152.2.24.1 as a component of openSUSE Leap 15.2 MozillaFirefox-buildsymbols-78.4.0-lp152.2.24.1 as a component of openSUSE Leap 15.2 MozillaFirefox-devel-78.4.0-lp152.2.24.1 as a component of openSUSE Leap 15.2 MozillaFirefox-translations-common-78.4.0-lp152.2.24.1 as a component of openSUSE Leap 15.2 MozillaFirefox-translations-other-78.4.0-lp152.2.24.1 as a component of openSUSE Leap 15.2 Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. CVE-2020-15683 openSUSE Leap 15.2:MozillaFirefox-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-branding-upstream-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-buildsymbols-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-devel-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-translations-common-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-translations-other-78.4.0-lp152.2.24.1 important 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CU2EYNXYAWD2VQ4FXESYJGATZGSMOZCO/ https://www.suse.com/security/cve/CVE-2020-15683.html CVE-2020-15683 https://bugzilla.suse.com/1177872 SUSE Bug 1177872 https://bugzilla.suse.com/1177977 SUSE Bug 1177977 Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15969 openSUSE Leap 15.2:MozillaFirefox-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-branding-upstream-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-buildsymbols-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-devel-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-translations-common-78.4.0-lp152.2.24.1 openSUSE Leap 15.2:MozillaFirefox-translations-other-78.4.0-lp152.2.24.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CU2EYNXYAWD2VQ4FXESYJGATZGSMOZCO/ https://www.suse.com/security/cve/CVE-2020-15969.html CVE-2020-15969 https://bugzilla.suse.com/1177408 SUSE Bug 1177408 https://bugzilla.suse.com/1177872 SUSE Bug 1177872 https://bugzilla.suse.com/1177977 SUSE Bug 1177977