Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202005-04 ] Mozilla Firefox: Multiple vulnerabilities
Date: Tue, 12 May 2020 23:38:21
Message-Id: d165c779-e05f-d17d-378a-1da4de741d61@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 202005-04
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: Mozilla Firefox: Multiple vulnerabilities
9 Date: May 12, 2020
10 Bugs: #721090
11 ID: 202005-04
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in Mozilla Firefox, the worst
19 of which could result in the arbitrary execution of code.
20
21 Background
22 ==========
23
24 Mozilla Firefox is a popular open-source web browser from the Mozilla
25 Project.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 www-client/firefox < 68.8.0 >= 68.8.0
34 2 www-client/firefox-bin < 68.8.0 >= 68.8.0
35 -------------------------------------------------------------------
36 2 affected packages
37
38 Description
39 ===========
40
41 Multiple vulnerabilities have been discovered in Mozilla Firefox.
42 Please review the CVE identifiers referenced below for details.
43
44 Impact
45 ======
46
47 A remote attacker could entice a user to view a specially crafted web
48 page, possibly resulting in the execution of arbitrary code with the
49 privileges of the process, an information leak or a Denial of Service
50 condition.
51
52 Workaround
53 ==========
54
55 There is no known workaround at this time.
56
57 Resolution
58 ==========
59
60 All Mozilla Firefox users should upgrade to the latest version:
61
62 # emerge --sync
63 # emerge --ask --oneshot --verbose ">=www-client/firefox-68.8.0"
64
65 All Mozilla Firefox binary users should upgrade to the latest version:
66
67 # emerge --sync
68 # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.8.0"
69
70 References
71 ==========
72
73 [ 1 ] CVE-2020-12387
74 https://nvd.nist.gov/vuln/detail/CVE-2020-12387
75 [ 2 ] CVE-2020-12392
76 https://nvd.nist.gov/vuln/detail/CVE-2020-12392
77 [ 3 ] CVE-2020-12394
78 https://nvd.nist.gov/vuln/detail/CVE-2020-12394
79 [ 4 ] CVE-2020-12395
80 https://nvd.nist.gov/vuln/detail/CVE-2020-12395
81 [ 5 ] CVE-2020-12396
82 https://nvd.nist.gov/vuln/detail/CVE-2020-12396
83 [ 6 ] CVE-2020-6831
84 https://nvd.nist.gov/vuln/detail/CVE-2020-6831
85 [ 7 ] MFSA-2020-17
86 https://www.mozilla.org/en-US/security/advisories/mfsa2020-17/
87
88 Availability
89 ============
90
91 This GLSA and any updates to it are available for viewing at
92 the Gentoo Security Website:
93
94 https://security.gentoo.org/glsa/202005-04
95
96 Concerns?
97 =========
98
99 Security is a primary focus of Gentoo Linux and ensuring the
100 confidentiality and security of our users' machines is of utmost
101 importance to us. Any security concerns should be addressed to
102 security@g.o or alternatively, you may file a bug at
103 https://bugs.gentoo.org.
104
105 License
106 =======
107
108 Copyright 2020 Gentoo Foundation, Inc; referenced text
109 belongs to its owner(s).
110
111 The contents of this document are licensed under the
112 Creative Commons - Attribution / Share Alike license.
113
114 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature
Report Message
Find on MARC Find on Google Groups