New mozilla-firefox packages are available for Slackware 14.2 and
-current to fix security issues.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-18 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender     email address that Thunderbird displays. (CVE-2020-12397)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. (CVE-2020-12392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 68.8.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-18 advisory.

  - Mozilla developers and community members Alexandru Michis, Jason Kratzer, philipp, Ted Campbell, Bas     Schouten, Andr Bargull, and Karl Tomlinson reported memory safety bugs present in Firefox 75 and Firefox     ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort     some of these could have been exploited to run arbitrary code. (CVE-2020-12395)

  - A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to     memory corruption and a potentially exploitable crash. (CVE-2020-6831)

  - By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender     email address that Thunderbird displays. (CVE-2020-12397)

  - A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This     resulted in a potentially exploitable crash. (CVE-2020-12387)

  - The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a     request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the     command into a terminal, it could have resulted in the disclosure of local files. (CVE-2020-12392)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox fixes the following issues :

Update to version 68.8.0 ESR (bsc#1171186) :

CVE-2020-12387: Use-after-free during worker shutdown

CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens

CVE-2020-12389: Sandbox escape with improperly separated process types

CVE-2020-6831: Buffer overflow in SCTP chunk input validation

CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'

CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
136392	Slackware 14.2 / current : mozilla-firefox (SSA:2020-126-01)	Nessus	Slackware Local Security Checks	2020/5/7	2024/3/13	critical
136358	Mozilla Thunderbird < 68.8.0	Nessus	MacOS X Local Security Checks	2020/5/7	2025/11/18	critical
136359	Mozilla Thunderbird < 68.8.0	Nessus	Windows	2020/5/7	2025/11/18	critical
136654	SUSE SLES12 Security Update : MozillaFirefox (SUSE-SU-2020:1218-1)	Nessus	SuSE Local Security Checks	2020/5/15	2024/3/12	critical

偵測

搜尋 Plugin

critical

critical

critical

critical