MGASA-2020-0318 - Updated firefox packages fix security vulnerability

Publication date: 18 Aug 2020
URL: https://advisories.mageia.org/MGASA-2020-0318.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2020-6463,
     CVE-2020-6514,
     CVE-2020-6829,
     CVE-2020-12400,
     CVE-2020-12401,
     CVE-2020-12403,
     CVE-2020-15652,
     CVE-2020-15659

WebRTC used the memory address of a class instance as a connection identifier.
Unfortunately, this value is often transmitted to the peer, which
allows bypassing ASLR (CVE-2020-6514).

Crafted media files could lead to a race in texture caches, resulting in a
use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture, memory
corruption, and a potentially exploitable crash (CVE-2020-6463).

By observing the stack trace for JavaScript errors in web workers, it was
possible to leak the result of a cross-origin redirect. This applied only to
content that can be parsed as script (CVE-2020-15652).

Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs
present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort some of these could
have been exploited to run arbitrary code (CVE-2020-15659).

Using the EM side-channel, it is possible to extract the position of zero and
non-zero wNAF digits while nss-certutil tool performs scalar multiplication
during the ECDSA signature generation, leaking partial information about the
ECDSA nonce. Given a small number of ECDSA signatures, this information can be
used to steal the private key. The highest threat from this vulnerability is to
data confidentiality (CVE-2020-6829).

A side channel flaw was found in the way P-384 and P-521 curses are used in
generation EDSA signatures, leaking partial information about the ECDSA nonce.
Given a small number of ECDSA signatures, this information can be used to steal
the private key. The highest threat from this vulnerability is to data
confidentiality (CVE-2020-12400).

Using the EM side-channel, it is possible to extract the position of zero and
non-zero wNAF digits while nss-certutil tool performs scalar multiplication
during the ECDSA signature generation, leaking partial information about the
ECDSA nonce. Given a small number of ECDSA signatures, this information can be
used to steal the private key. The highest threat from this vulnerability is to
data confidentiality (CVE-2020-12401).

Multi-part ChaCha20 was not functioning correctly and tag length was not
strictly enforced (CVE-2020-12403).

References:
- https://bugs.mageia.org/show_bug.cgi?id=27011
- https://groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/3626XG8mLJw
- https://bugzilla.redhat.com/show_bug.cgi?id=1826187
- https://bugzilla.redhat.com/show_bug.cgi?id=1853983
- https://bugzilla.redhat.com/show_bug.cgi?id=1851294
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-31/
- https://ubuntu.com/security/notices/USN-4455-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6463
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6514
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6829
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12400
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12401
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12403
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15652
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15659

SRPMS:
- 7/core/firefox-68.11.0-1.mga7
- 7/core/firefox-l10n-68.11.0-1.mga7
- 7/core/nspr-4.27-1.mga7
- 7/core/nss-3.52.1-1.2.mga7