This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues :

Security issues fixed :

  - CVE-2020-12415: AppCache manifest poisoning due to url     encoded character processing (bsc#1173576).

  - CVE-2020-12416: Use-after-free in WebRTC     VideoBroadcaster (bsc#1173576).

  - CVE-2020-12417: Memory corruption due to missing     sign-extension for ValueTags on ARM64 (bsc#1173576).

  - CVE-2020-12418: Information disclosure due to     manipulated URL object (bsc#1173576).

  - CVE-2020-12419: Use-after-free in nsGlobalWindowInner     (bsc#1173576).

  - CVE-2020-12420: Use-After-Free when trying to connect to     a STUN server (bsc#1173576).

  - CVE-2020-12402: RSA Key Generation vulnerable to     side-channel attack (bsc#1173576).

  - CVE-2020-12421: Add-On updates did not respect the same     certificate trust rules as software updates     (bsc#1173576).

  - CVE-2020-12422: Integer overflow in     nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).

  - CVE-2020-12423: DLL Hijacking due to searching %PATH%     for a library (bsc#1173576).

  - CVE-2020-12424: WebRTC permission prompt could have been     bypassed by a compromised content process (bsc#1173576).

  - CVE-2020-12425: Out of bound read in Date.parse()     (bsc#1173576).

  - CVE-2020-12426: Memory safety bugs fixed in Firefox 78     (bsc#1173576).

  - FIPS: MozillaFirefox: allow     /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed :

  - Fixed interaction with freetype6 (bsc#1173613).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues :

Security issues fixed :

CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).

CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).

CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).

CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).

CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).

CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).

CVE-2020-12402: RSA Key Generation vulnerable to side-channel attack (bsc#1173576).

CVE-2020-12421: Add-On updates did not respect the same certificate trust rules as software updates (bsc#1173576).

CVE-2020-12422: Integer overflow in nsJPEGEncoder::emptyOutputBuffer (bsc#1173576).

CVE-2020-12423: DLL Hijacking due to searching %PATH% for a library (bsc#1173576).

CVE-2020-12424: WebRTC permission prompt could have been bypassed by a compromised content process (bsc#1173576).

CVE-2020-12425: Out of bound read in Date.parse() (bsc#1173576).

CVE-2020-12426: Memory safety bugs fixed in Firefox 78 (bsc#1173576).

FIPS: MozillaFirefox: allow /proc/sys/crypto/fips_enabled (bsc#1167231).

Non-security issues fixed :

Fixed interaction with freetype6 (bsc#1173613).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaThunderbird to version 68.10.0 ESR fixes the following issues :

  - CVE-2020-12417: Memory corruption due to missing     sign-extension for ValueTags on ARM64 (bsc#1173576).

  - CVE-2020-12418: Information disclosure due to     manipulated URL object (bsc#1173576).

  - CVE-2020-12419: Use-after-free in nsGlobalWindowInner     (bsc#1173576).

  - CVE-2020-12420: Use-After-Free when trying to connect to     a STUN server (bsc#1173576).

  - CVE-2020-12421: Add-On updates did not respect the same     certificate trust rules as software updates     (bsc#1173576).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2824 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.10.0 ESR.

    Security Fix(es):

    * Mozilla: Information disclosure due to manipulated URL object (CVE-2020-12418)

    * Mozilla: Use-after-free in nsGlobalWindowInner (CVE-2020-12419)

    * Mozilla: Use-After-Free when trying to connect to a STUN server (CVE-2020-12420)

    * Mozilla: Add-On updates did not respect the same certificate trust rules as software updates     (CVE-2020-12421)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2020-2906 advisory.

    [68.10.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [68.10.0-1]
    - Update to 68.10.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
138747	openSUSE Security Update : MozillaFirefox (openSUSE-2020-983)	Nessus	SuSE Local Security Checks	7/20/2020	2/29/2024	high
138493	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2020:1898-1)	Nessus	SuSE Local Security Checks	7/15/2020	3/1/2024	high
138746	openSUSE Security Update : MozillaThunderbird (openSUSE-2020-982)	Nessus	SuSE Local Security Checks	7/20/2020	2/29/2024	high
138145	RHEL 6 : firefox (RHSA-2020:2824)	Nessus	Red Hat Local Security Checks	7/7/2020	11/7/2024	high
138487	Oracle Linux 7 : thunderbird (ELSA-2020-2906)	Nessus	Oracle Linux Local Security Checks	7/15/2020	10/22/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high