SUSE-SU-2021:0072-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2021:0072-1

HIGH7.5

Security update for MozillaFirefox

Published Jan 12, 2021

Modified 5 years ago

Fix available

Details

Description of the patch:

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 78.6.1 ESR
- Fixed: Critical security issue MFSA 2021-01 (bsc#1180623)
- CVE-2020-16044 Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk

Affected Packages

MozillaFirefox

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Desktop Applications 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

78.6.1-3.125.1

MozillaFirefox-devel

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Desktop Applications 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

78.6.1-3.125.1

MozillaFirefox-translations-common

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Desktop Applications 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

78.6.1-3.125.1

MozillaFirefox-translations-other

SUSE Enterprise Storage 6SUSE Linux Enterprise Desktop 15 SP1SUSE Linux Enterprise High Performance Computing 15 SP1SUSE Linux Enterprise Module for Desktop Applications 15 SP1SUSE Linux Enterprise Server 15 SP1

Fixed in:

78.6.1-3.125.1

References

https://bugzilla.suse.com/1180623

https://lists.suse.com/pipermail/sle-security-updates/2021-January/008170.html

https://www.suse.com/security/cve/CVE-2020-16044/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2021/suse-su-20210072-1/

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

HighAC:H

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Upstream

Ecosystems(9)

SUSE Enterprise Storage 6 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 SUSE Linux Enterprise Server 15 SP1

Timeline

PublishedJan 12, 2021

ModifiedJan 12, 2021