Google and Mozilla address serious flaws in Firefox and Chrome browsers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-6455 | Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Out of bounds read in WebSQL in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. NVD description · AI analysis pending | 8.8 | 2% |
| — | ||
| CVE-2020-6825 | Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 74 and Firefox ESR 68.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75. NVD description · AI analysis pending | 9.8 group max | 2% |
| — | ||
| CVE-2020-6828 +1 in the same advisory: …6827 | A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the us A malicious Android application could craft an Intent that would have been processed by Firefox for Android and potentially result in a file overwrite in the user's profile directory. One exploitation vector for this would be to supply a user.js file providing arbitrary malicious preference values. Control of arbitrary preferences can lead to sufficient compromise such that it is generally equivalent to arbitrary code execution. *Note: This issue only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.7. NVD description · AI analysis pending | 7.5 group max | 2% |
| — |
Full article407 words · extracted from securityaffairs.com · click to collapse
Google and Mozilla released new versions of Chrome and Firefox browsers to addressed several high-severity vulnerabilities.
Mozilla has released Firefox version 75 that includes six security patches for the desktop, and two patches targeting to address vulnerabilities in the Android app.
“With today’s release, a number of improvements will help you search smarter, faster.” reads the announcement.
Mozilla fixed three high-severity vulnerabilities, two of which are memory safety bugs tracked as CVE-2020-6825 and CVE-2020-6826 that could lead to arbitrary code execution.
“Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.” Mozilla explains.
The arbitrary code execution for Firefox for Android was tracked as CVE-2020-6828.
The other two high-risk bugs could be respectively exploited to leak sensitive data (CVE-2020-6821) or to trick the mobile browser into displaying the incorrect URI (CVE-2020-6827).
Mozilla fixed a moderate severity rating flaw tracked as CVE-2020-6822 that could lead to code execution as well, along with two other two issues tracked as CVE-2020-6823 and CVE-2020-6824.
Google released Chrome version 81 that includes 32 security flaws, three of which are rated high-risk severity, eight medium-severity issues, and twelve low-risk bugs.
“The Chrome team is delighted to announce the promotion of Chrome 81 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks.” reads the post published by Google.
“Chrome 81.0.4044.92 contains a number of fixes and improvements — a list of changes is available in the log. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 81.”
The most severe flaw tracked as CVE-2020-6454 is a use-after-free vulnerability in extensions, the remaining two other high-risk issues were a use-after-free in audio tracked as CVE-2020-6423 and an out-of-bounds read in WebSQL tracked as CVE-2020-6455.
Half of the medium-severity vulnerabilities were insufficient policy enforcement bugs, type confusion in V8, insufficient validation of untrusted input in clipboard, use-after-free in devtools, and use-after-free in window management.
Low-severity bugs were insufficient policy enforcements, inappropriate implementations, uninitialized use in WebRTC, and use-after-free in V8.
Google says it paid over $26,000 in bug bounty rewards to the reporting security researchers, but the company has yet to disclose the exact amount it awarded for all of the externally reported vulnerabilities.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – Mozilla Firefox, Google Chrome)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/101334/security/firefox-chrome-browsers-flaws.html