SUSE-SU-2020:14456-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2020/suse-su-202014456-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2020:14456-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2020:14456-1
Related
Published
2020-08-18T10:11:12Z
Modified
2020-08-18T10:11:12Z
Summary
Security update for MozillaFirefox
Details

This update for MozillaFirefox fixes the following issues:

  • Fix broken translation-loading (boo#1173991)
    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

  • Mozilla Firefox 78.1 ESR

    • Fixed: Various stability, functionality, and security fixe (MFSA 2020-32) (bsc#1174538).
    • CVE-2020-15652 (bmo#1634872) Potential leak of redirect targets when loading scripts in a worker
    • CVE-2020-6514 (bmo#1642792) WebRTC data channel leaks internal address to peer
    • CVE-2020-15655 (bmo#1645204) Extension APIs could be used to bypass Same-Origin Policy
    • CVE-2020-15653 (bmo#1521542) Bypassing iframe sandbox when allowing popups
    • CVE-2020-6463 (bmo#1635293) Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
    • CVE-2020-15656 (bmo#1647293) Type confusion for special arguments in IonMonkey
    • CVE-2020-15658 (bmo#1637745) Overriding file type when saving to disk
    • CVE-2020-15657 (bmo#1644954) DLL hijacking due to incorrect loading path
    • CVE-2020-15654 (bmo#1648333) Custom cursor can overlay user interface
    • CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1643613, bmo#1644839, bmo#1645835, bmo#1646006, bmo#1646787, bmo#1649347, bmo#1650811, bmo#1651678) Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

  • Add sle11-icu-generation-python3.patch to fix icu-generation on big endian platforms

  • Mozilla Firefox 78.0.2 ESR

    • MFSA 2020-28 (bsc#1173948)
    • MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or embed tags
    • Fixed: Fixed an accessibility regression in reader mode (bmo#1650922)
    • Fixed: Made the address bar more resilient to data corruption in the user profile (bmo#1649981)
    • Fixed: Fixed a regression opening certain external applications (bmo#1650162)
References

Affected packages

SUSE:Linux Enterprise Server 11 SP4-LTSS / MozillaFirefox

Package

Name
MozillaFirefox
Purl
purl:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
78.1.0-78.87.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "78.1.0-78.87.1",
            "MozillaFirefox-translations-common": "78.1.0-78.87.1",
            "MozillaFirefox-translations-other": "78.1.0-78.87.1"
        }
    ]
}