Security update for MozillaFirefox SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:3022-1 Final 1 1 2020-10-23T12:21:06Z current 2020-10-23T12:21:06Z 2020-10-23T12:21:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 78.4.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2020-46 (bsc#1177872, bsc#1176756) * CVE-2020-15969 Use-after-free in usersctp * CVE-2020-15683 Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 * Fixed: Fixed legacy preferences not being properly applied when set via GPO The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-LI-BYOS-Production-2020-3022,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-3022,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-3022,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-3022,SUSE-2020-3022,SUSE-SLE-Module-Desktop-Applications-15-SP1-2020-3022 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20203022-1/ Link for SUSE-SU-2020:3022-1 https://lists.suse.com/pipermail/sle-security-updates/2020-October/007616.html E-Mail link for SUSE-SU-2020:3022-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1176756 SUSE Bug 1176756 https://bugzilla.suse.com/1177872 SUSE Bug 1177872 https://www.suse.com/security/cve/CVE-2020-15683/ SUSE CVE CVE-2020-15683 page https://www.suse.com/security/cve/CVE-2020-15969/ SUSE CVE CVE-2020-15969 page Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-78.4.0-3.113.3 MozillaFirefox-branding-upstream-78.4.0-3.113.3 MozillaFirefox-buildsymbols-78.4.0-3.113.3 MozillaFirefox-devel-78.4.0-3.113.3 MozillaFirefox-translations-common-78.4.0-3.113.3 MozillaFirefox-translations-other-78.4.0-3.113.3 MozillaFirefox-78.4.0-3.113.3 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production MozillaFirefox-78.4.0-3.113.3 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production MozillaFirefox-78.4.0-3.113.3 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production MozillaFirefox-78.4.0-3.113.3 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production MozillaFirefox-78.4.0-3.113.3 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-devel-78.4.0-3.113.3 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-translations-common-78.4.0-3.113.3 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-translations-other-78.4.0-3.113.3 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. CVE-2020-15683 Image SLES15-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 Image SLES15-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-78.4.0-3.113.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203022-1/ https://www.suse.com/security/cve/CVE-2020-15683.html CVE-2020-15683 https://bugzilla.suse.com/1177872 SUSE Bug 1177872 https://bugzilla.suse.com/1177977 SUSE Bug 1177977 Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. CVE-2020-15969 Image SLES15-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 Image SLES15-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-78.4.0-3.113.3 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-78.4.0-3.113.3 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20203022-1/ https://www.suse.com/security/cve/CVE-2020-15969.html CVE-2020-15969 https://bugzilla.suse.com/1177408 SUSE Bug 1177408 https://bugzilla.suse.com/1177872 SUSE Bug 1177872 https://bugzilla.suse.com/1177977 SUSE Bug 1177977