ID

VAR-202011-0444

CVE

CVE-2020-15969

TITLE

Google Chrome  Vulnerabilities in the use of freed memory

DESCRIPTION

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Google Chrome Is vulnerable to the use of freed memory.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Google Chrome is a web browser developed by Google (Google). Chrome has security holes. 6) - i386, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2020-12-14-7 tvOS 14.3 tvOS 14.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212005. CoreAudio Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-27948: JunDong Xie of Ant Security Light-Year Lab FontParser Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An information disclosure issue was addressed with improved state management. CVE-2020-27946: Mateusz Jurczyk of Google Project Zero FontParser Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. CVE-2020-27943: Mateusz Jurczyk of Google Project Zero CVE-2020-27944: Mateusz Jurczyk of Google Project Zero ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to heap corruption Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-29617: XingWei Lin of Ant Security Light-Year Lab CVE-2020-29619: XingWei Lin of Ant Security Light-Year Lab ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-29618: XingWei Lin of Ant Security Light-Year Lab ImageIO Available for: Apple TV 4K and Apple TV HD Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-29611: Ivan Fratric of Google Project Zero WebRTC Available for: Apple TV 4K and Apple TV HD Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-15969: an anonymous researcher Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbURczHs1TP07VIfuZcsbuWJ6jjAFAl/YBnkACgkQZcsbuWJ6 jjAdUA/+IW1Va0vmKcDFand0B8Y1lkRDdThXQ/lQmLJCPNJ1hQLQZSLUzpYvjyLi UAepoh/ToYtt9YivitmjfNHxjLvYw/xRV13cpsVMcCvQhhS1N5s4aJEL6f+0LEhv 6U0JvjGoa6/By4sQksdPZnipoNRzEJ3KWRJrFkLnGwvH+uT6KbuzjXqfHwkHJfV2 XgghEJzvoLT1cbXp6XNO/YOV++eeDBkW0L80YukQ2RPDHi3N99Aue9ADe+pbQJH1 eJBWdZV99zjHZrStXKBQ7CF5i9hJnludrMo0V+RgMXRhLrfW5dm6Ww3kLm4okj+D spAJy8WepCRFwth9+yFcmdxyv2aZJ0MvxuFAIL6Sv9E0FvMW8fPbRHcsJDDTAt4f mKUPwUex183P7li3SYEK/I1ItcMh039wlulkiP5xw/6JGDIDh7ryOaTPCvnz+MIx OzcgtdNFLcTA2BDEQwITEp+fpuqAlXw3ykbq5yYZz3AJXxKLVXVLeuB1oEkHJmRi 4EUXb7Lb5TEoMj1dbCmmr6q3eWGCPj5CJcTFJMTNWx8aW4u889mi7FqCnXasAc3M jg5eSRy+97+tOsdgUYFoMekJqF8jJbljDH1NDmEbMtVc+F7jT4khXN9fRLvqN6An P4web66vaHKZbUnMDtXHjMSkfniHUT39JKm7CJPNC/vf2HF9HQM=4OzT -----END PGP SIGNATURE----- . Background ========= Library for rendering dynamic web content in Qt5 C++ and QML applications. 8.0) - ppc64le, x86_64 3. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202010-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mozilla Firefox, Mozilla Thunderbird: Multiple vulnerabilities Date: October 28, 2020 Bugs: #750446 ID: 202010-08 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Mozilla Firefox and Mozilla Thunderbird, the worst of which could result in the arbitrary execution of code. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/firefox < 82.0 >= 78.4.0:0/esr78 > = 82.0 2 www-client/firefox-bin < 82.0 >= 78.4.0:0/esr78 > = 82.0 3 mail-client/thunderbird < 78.4.0 >= 78.4.0 4 mail-client/thunderbird-bin < 78.4.0 >= 78.4.0 ------------------------------------------------------------------- 4 affected packages Description =========== Multiple vulnerabilities have been discovered in Mozilla Firefox and Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact ====== Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Mozilla Firefox users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-82.0" All Mozilla Firefox (bin) users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-82.0" All Mozilla Firefox ESR users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-client/firefox-78.4.0:0/esr78" All Mozilla Firefox ESR (bin) users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=www-client/firefox-bin-78.4.0:0/esr78" All Mozilla Thunderbird users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-.4.0" All Mozilla Thunderbird (bin) users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=mail-client/thunderbird-bin-78.4.0" References ========== [ 1 ] CVE-2020-15683 https://nvd.nist.gov/vuln/detail/CVE-2020-15683 [ 2 ] CVE-2020-15969 https://nvd.nist.gov/vuln/detail/CVE-2020-15969 [ 3 ] MFSA-2020-45 https://www.mozilla.org/en-US/security/advisories/mfsa2020-45/ [ 4 ] MFSA-2020-46 https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/ [ 5 ] MFSA-2020-47 https://www.mozilla.org/en-US/security/advisories/mfsa2020-47/ Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202010-08 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2020:4310-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4310 Issue date: 2020-10-22 CVE Names: CVE-2020-15683 CVE-2020-15969 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.4.0 ESR. Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683) * chromium-browser: Use after free in WebRTC (CVE-2020-15969) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1885885 - CVE-2020-15969 chromium-browser: Use after free in WebRTC 1889932 - CVE-2020-15683 Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: firefox-78.4.0-1.el7_9.src.rpm x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: firefox-78.4.0-1.el7_9.i686.rpm Red Hat Enterprise Linux Server (v. 7): Source: firefox-78.4.0-1.el7_9.src.rpm ppc64: firefox-78.4.0-1.el7_9.ppc64.rpm firefox-debuginfo-78.4.0-1.el7_9.ppc64.rpm ppc64le: firefox-78.4.0-1.el7_9.ppc64le.rpm firefox-debuginfo-78.4.0-1.el7_9.ppc64le.rpm s390x: firefox-78.4.0-1.el7_9.s390x.rpm firefox-debuginfo-78.4.0-1.el7_9.s390x.rpm x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): x86_64: firefox-78.4.0-1.el7_9.i686.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: firefox-78.4.0-1.el7_9.src.rpm x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: firefox-78.4.0-1.el7_9.i686.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-15683 https://access.redhat.com/security/cve/CVE-2020-15969 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX5G+ntzjgjWX9erEAQhmDQ//dHDny/ImuLP8xvK4PtLEY7BRvrOS/vY2 YkKEGdGOQa48sBw+5Y2tSqra5gKOqf5H3lcxj+sTG97hUStgrNAucZpTHaKm7vde /Eb3PIFWOqnNpcvDg6njU/q5ttA7YC0PHizRfH0Yix5EUAkKZnMWlcS8Lkm5FEM2 Ws+UfvgB/+Gx03I2MioDwnnHnnZLR+pmt7EYl7CnKLRMYsQVEkrlc2b7gCzPlijo UV91wcUoX4s9/v/i2afTY8CqhDs8MNHFnsVX+FTCyGbezamAxJ+YTKtDgKDiG+7v up2fIlMhf8eKnkEpyOebDDPo8vECJr311rXT0qg6/jkx9iogOyHskOcmTYIK5xzT R9gmF+gvsJsMeHzD6a6uh5BsLLS7rtIESWO91IS0FofOAv0lkkOqG1xlAq4zAKYc 8NrzZ0omzrB9rRK2LeKp2oAP0xIoFQiTmicoBAvRijNPRSWT8SZY/IfOsSvrbfkG rGOY4nNaLVQUqXv7+BKa/LusfBhQkGgxcKO/uNX7xWGTEqH4ysx7/ELKmQ1LjZxw bgYhrYaSkSMAQ5r/Nf0qMHLLxvMUqmJmgkExE0rLwogxWVYZWVCiIwI0wncDCFEo mw8HZ58JlTWTv2owGc8I0fo+ln7Y5xmuXuyN6AldueladP0AdtdNyaw/GHquCytW o2ukWK2zUE8=oczW -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Gentoo

SOURCES

LAST UPDATE DATE

2025-06-26T19:58:25.891000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE