Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2020-15969
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T13:30:23.456Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://crbug.com/1124659" }, { "name": "openSUSE-SU-2020:1829", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "name": "FEDORA-2020-127d40f1ab", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/" }, { "name": "FEDORA-2020-8aca25b5c8", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/" }, { "name": "FEDORA-2020-4e8e48da22", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/kb/HT212009" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/kb/HT212011" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/kb/HT212005" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/kb/HT212003" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://support.apple.com/kb/HT212007" }, { "name": "20201215 APPLE-SA-2020-12-14-5 watchOS 7.2", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/27" }, { "name": "20201215 APPLE-SA-2020-12-14-8 Safari 14.0.2", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/30" }, { "name": "20201215 APPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/24" }, { "name": "20201215 APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/26" }, { "name": "20201215 APPLE-SA-2020-12-14-7 tvOS 14.3", "tags": [ "mailing-list", "x_refsource_FULLDISC", "x_transferred" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/29" }, { "name": "DSA-4824", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2021/dsa-4824" }, { "name": "GLSA-202101-30", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202101-30" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Chrome", "vendor": "Google", "versions": [ { "lessThan": "86.0.4240.75", "status": "affected", "version": "unspecified", "versionType": "custom" } ] } ], "descriptions": [ { "lang": "en", "value": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." } ], "problemTypes": [ { "descriptions": [ { "description": "Use after free", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2021-01-26T02:07:24", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://crbug.com/1124659" }, { "name": "openSUSE-SU-2020:1829", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "name": "FEDORA-2020-127d40f1ab", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/" }, { "name": "FEDORA-2020-8aca25b5c8", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/" }, { "name": "FEDORA-2020-4e8e48da22", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/kb/HT212009" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/kb/HT212011" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/kb/HT212005" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/kb/HT212003" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://support.apple.com/kb/HT212007" }, { "name": "20201215 APPLE-SA-2020-12-14-5 watchOS 7.2", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/27" }, { "name": "20201215 APPLE-SA-2020-12-14-8 Safari 14.0.2", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/30" }, { "name": "20201215 APPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/24" }, { "name": "20201215 APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/26" }, { "name": "20201215 APPLE-SA-2020-12-14-7 tvOS 14.3", "tags": [ "mailing-list", "x_refsource_FULLDISC" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/29" }, { "name": "DSA-4824", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2021/dsa-4824" }, { "name": "GLSA-202101-30", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/202101-30" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "chrome-cve-admin@google.com", "ID": "CVE-2020-15969", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Chrome", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "86.0.4240.75" } ] } } ] }, "vendor_name": "Google" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Use after free" } ] } ] }, "references": { "reference_data": [ { "name": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "refsource": "MISC", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "name": "https://crbug.com/1124659", "refsource": "MISC", "url": "https://crbug.com/1124659" }, { "name": "openSUSE-SU-2020:1829", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "name": "FEDORA-2020-127d40f1ab", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/" }, { "name": "FEDORA-2020-8aca25b5c8", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/" }, { "name": "FEDORA-2020-4e8e48da22", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/" }, { "name": "https://support.apple.com/kb/HT212009", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212009" }, { "name": "https://support.apple.com/kb/HT212011", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212011" }, { "name": "https://support.apple.com/kb/HT212005", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212005" }, { "name": "https://support.apple.com/kb/HT212003", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212003" }, { "name": "https://support.apple.com/kb/HT212007", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212007" }, { "name": "20201215 APPLE-SA-2020-12-14-5 watchOS 7.2", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/27" }, { "name": "20201215 APPLE-SA-2020-12-14-8 Safari 14.0.2", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/30" }, { "name": "20201215 APPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/24" }, { "name": "20201215 APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/26" }, { "name": "20201215 APPLE-SA-2020-12-14-7 tvOS 14.3", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/29" }, { "name": "DSA-4824", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2021/dsa-4824" }, { "name": "GLSA-202101-30", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202101-30" } ] } } } }, "cveMetadata": { "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2020-15969", "datePublished": "2020-11-03T02:21:27", "dateReserved": "2020-07-27T00:00:00", "dateUpdated": "2024-08-04T13:30:23.456Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-15969\",\"sourceIdentifier\":\"chrome-cve-admin@google.com\",\"published\":\"2020-11-03T03:15:12.790\",\"lastModified\":\"2024-11-21T05:06:34.250\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\"},{\"lang\":\"es\",\"value\":\"Un uso de la memoria previamente liberada en WebRTC en Google Chrome anterior a versi\u00f3n 86.0.4240.75, permit\u00eda a un atacante remoto explotar potencialmente una corrupci\u00f3n de la pila por medio de una p\u00e1gina HTML dise\u00f1ada\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"86.0.4240.75\",\"matchCriteriaId\":\"92B391C8-0D51-4BBE-AA06-25E534ED49DD\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"67E82302-4B77-44F3-97B1-24C18AC4A35D\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.0.2\",\"matchCriteriaId\":\"E743245B-52BC-40A6-B4EF-09BE2C606FC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.3\",\"matchCriteriaId\":\"0D8BA3D3-D515-4592-9805-E7B3C17343AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.3\",\"matchCriteriaId\":\"8B16DB0D-3DD4-492A-9D99-670C7B6136EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"11.1\",\"matchCriteriaId\":\"34BD2DC9-459A-46A3-82C8-ECA892F3B3D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"14.3\",\"matchCriteriaId\":\"24E35E29-5575-4EEB-B8A6-D333149E4B3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.2\",\"matchCriteriaId\":\"EBB77299-35F0-4730-9853-D939C77E3FBE\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/24\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/26\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/27\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/29\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/30\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://crbug.com/1124659\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://security.gentoo.org/glsa/202101-30\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212003\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212005\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212007\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212009\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212011\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-4824\",\"source\":\"chrome-cve-admin@google.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/24\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/26\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/27\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/29\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://seclists.org/fulldisclosure/2020/Dec/30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://crbug.com/1124659\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202101-30\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212003\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212005\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212007\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212009\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://support.apple.com/kb/HT212011\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-4824\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2020_4317
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 78.4.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4317", "url": "https://access.redhat.com/errata/RHSA-2020:4317" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4317.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T15:51:31+00:00", "generator": { "date": "2024-11-22T15:51:31+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4317", "initial_release_date": "2020-10-22T20:56:02+00:00", "revision_history": [ { "date": "2020-10-22T20:56:02+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-22T20:56:02+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:31+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_2.s390x", "product": { "name": "firefox-0:78.4.0-1.el8_2.s390x", "product_id": "firefox-0:78.4.0-1.el8_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_2?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_2.s390x", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.s390x", "product_id": "firefox-debugsource-0:78.4.0-1.el8_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_2?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_2?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_2.x86_64", "product": { "name": "firefox-0:78.4.0-1.el8_2.x86_64", "product_id": "firefox-0:78.4.0-1.el8_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_2?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_2.x86_64", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.x86_64", "product_id": "firefox-debugsource-0:78.4.0-1.el8_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_2?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_2.ppc64le", "product": { "name": "firefox-0:78.4.0-1.el8_2.ppc64le", "product_id": "firefox-0:78.4.0-1.el8_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_2?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "product_id": "firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_2?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_2?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_2.aarch64", "product": { "name": "firefox-0:78.4.0-1.el8_2.aarch64", "product_id": "firefox-0:78.4.0-1.el8_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_2?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "product_id": "firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_2?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_2?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_2.src", "product": { "name": "firefox-0:78.4.0-1.el8_2.src", "product_id": "firefox-0:78.4.0-1.el8_2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_2?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64" }, "product_reference": "firefox-0:78.4.0-1.el8_2.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el8_2.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x" }, "product_reference": "firefox-0:78.4.0-1.el8_2.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_2.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src" }, "product_reference": "firefox-0:78.4.0-1.el8_2.src", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el8_2.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_2.s390x", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_2.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.MAIN.EUS" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T20:56:02+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4317" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T20:56:02+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4317" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.MAIN.EUS:firefox-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.s390x", "AppStream-8.2.0.Z.MAIN.EUS:firefox-debugsource-0:78.4.0-1.el8_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4913
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 78.4.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4913", "url": "https://access.redhat.com/errata/RHSA-2020:4913" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4913.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T15:52:03+00:00", "generator": { "date": "2024-11-22T15:52:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4913", "initial_release_date": "2020-11-04T13:28:29+00:00", "revision_history": [ { "date": "2020-11-04T13:28:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-04T13:28:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:52:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_3.x86_64", "product": { "name": "thunderbird-0:78.4.0-1.el8_3.x86_64", "product_id": "thunderbird-0:78.4.0-1.el8_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_3?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_3?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_3.ppc64le", "product": { "name": "thunderbird-0:78.4.0-1.el8_3.ppc64le", "product_id": "thunderbird-0:78.4.0-1.el8_3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_3?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_3?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_3?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_3.aarch64", "product": { "name": "thunderbird-0:78.4.0-1.el8_3.aarch64", "product_id": "thunderbird-0:78.4.0-1.el8_3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_3?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_3?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_3?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_3.src", "product": { "name": "thunderbird-0:78.4.0-1.el8_3.src", "product_id": "thunderbird-0:78.4.0-1.el8_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_3?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64" }, "product_reference": "thunderbird-0:78.4.0-1.el8_3.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el8_3.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_3.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src" }, "product_reference": "thunderbird-0:78.4.0-1.el8_3.src", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el8_3.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64", "relates_to_product_reference": "AppStream-8.3.0.Z.MAIN" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T13:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4913" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T13:28:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4913" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.src", "AppStream-8.3.0.Z.MAIN:thunderbird-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debuginfo-0:78.4.0-1.el8_3.x86_64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.aarch64", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.ppc64le", "AppStream-8.3.0.Z.MAIN:thunderbird-debugsource-0:78.4.0-1.el8_3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4945
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 78.4.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4945", "url": "https://access.redhat.com/errata/RHSA-2020:4945" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4945.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T15:52:10+00:00", "generator": { "date": "2024-11-22T15:52:10+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4945", "initial_release_date": "2020-11-05T09:08:47+00:00", "revision_history": [ { "date": "2020-11-05T09:08:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-05T09:08:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:52:10+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.1::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_1.x86_64", "product": { "name": "thunderbird-0:78.4.0-1.el8_1.x86_64", "product_id": "thunderbird-0:78.4.0-1.el8_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_1?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_1?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_1.ppc64le", "product": { "name": "thunderbird-0:78.4.0-1.el8_1.ppc64le", "product_id": "thunderbird-0:78.4.0-1.el8_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_1?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_1?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_1?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_1.src", "product": { "name": "thunderbird-0:78.4.0-1.el8_1.src", "product_id": "thunderbird-0:78.4.0-1.el8_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_1?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el8_1.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src" }, "product_reference": "thunderbird-0:78.4.0-1.el8_1.src", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el8_1.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T09:08:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4945" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T09:08:47+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4945" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:thunderbird-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4235
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 86.0.4240.75.\n\nSecurity Fix(es):\n\n* chromium-browser: Use after free in payments (CVE-2020-15967)\n\n* chromium-browser: Use after free in Blink (CVE-2020-15968)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\n* chromium-browser: Use after free in NFC (CVE-2020-15970)\n\n* chromium-browser: Use after free in printing (CVE-2020-15971)\n\n* chromium-browser: Use after free in audio (CVE-2020-15972)\n\n* chromium-browser: Use after free in autofill (CVE-2020-15990)\n\n* chromium-browser: Use after free in password manager (CVE-2020-15991)\n\n* chromium-browser: Inappropriate implementation in networking (CVE-2020-6557)\n\n* chromium-browser: Insufficient policy enforcement in extensions (CVE-2020-15973)\n\n* chromium-browser: Integer overflow in Blink (CVE-2020-15974)\n\n* chromium-browser: Integer overflow in SwiftShader (CVE-2020-15975)\n\n* chromium-browser: Use after free in WebXR (CVE-2020-15976)\n\n* chromium-browser: Insufficient data validation in dialogs (CVE-2020-15977)\n\n* chromium-browser: Insufficient data validation in navigation (CVE-2020-15978)\n\n* chromium-browser: Inappropriate implementation in V8 (CVE-2020-15979)\n\n* chromium-browser: Insufficient policy enforcement in Intents (CVE-2020-15980)\n\n* chromium-browser: Out of bounds read in audio (CVE-2020-15981)\n\n* chromium-browser: Side-channel information leakage in cache (CVE-2020-15982)\n\n* chromium-browser: Insufficient data validation in webUI (CVE-2020-15983)\n\n* chromium-browser: Insufficient policy enforcement in Omnibox (CVE-2020-15984)\n\n* chromium-browser: Inappropriate implementation in Blink (CVE-2020-15985)\n\n* chromium-browser: Integer overflow in media (CVE-2020-15986)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15987)\n\n* chromium-browser: Insufficient policy enforcement in networking (CVE-2020-15992)\n\n* chromium-browser: Insufficient policy enforcement in downloads (CVE-2020-15988)\n\n* chromium-browser: Uninitialized use in PDFium (CVE-2020-15989)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4235", "url": "https://access.redhat.com/errata/RHSA-2020:4235" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "1885883", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885883" }, { "category": "external", "summary": "1885884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885884" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1885886", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885886" }, { "category": "external", "summary": "1885887", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885887" }, { "category": "external", "summary": "1885888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885888" }, { "category": "external", "summary": "1885889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885889" }, { "category": "external", "summary": "1885890", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885890" }, { "category": "external", "summary": "1885891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885891" }, { "category": "external", "summary": "1885892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885892" }, { "category": "external", "summary": "1885893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885893" }, { "category": "external", "summary": "1885894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885894" }, { "category": "external", "summary": "1885896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885896" }, { "category": "external", "summary": "1885897", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885897" }, { "category": "external", "summary": "1885899", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885899" }, { "category": "external", "summary": "1885901", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885901" }, { "category": "external", "summary": "1885902", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885902" }, { "category": "external", "summary": "1885903", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885903" }, { "category": "external", "summary": "1885904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885904" }, { "category": "external", "summary": "1885905", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885905" }, { "category": "external", "summary": "1885906", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885906" }, { "category": "external", "summary": "1885907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885907" }, { "category": "external", "summary": "1885908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885908" }, { "category": "external", "summary": "1885909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885909" }, { "category": "external", "summary": "1885910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885910" }, { "category": "external", "summary": "1885911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885911" }, { "category": "external", "summary": "1885912", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885912" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4235.json" } ], "title": "Red Hat Security Advisory: chromium-browser security update", "tracking": { "current_release_date": "2024-11-15T09:37:30+00:00", "generator": { "date": "2024-11-15T09:37:30+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4235", "initial_release_date": "2020-10-13T08:22:05+00:00", "revision_history": [ { "date": "2020-10-13T08:22:05+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-13T08:22:05+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T09:37:30+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "product": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "product_id": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@86.0.4240.75-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "product": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "product_id": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@86.0.4240.75-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "product_id": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@86.0.4240.75-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "product_id": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@86.0.4240.75-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-6557", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885896" } ], "notes": [ { "category": "description", "text": "Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Inappropriate implementation in networking", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-6557" }, { "category": "external", "summary": "RHBZ#1885896", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885896" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-6557", "url": "https://www.cve.org/CVERecord?id=CVE-2020-6557" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-6557", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-6557" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Inappropriate implementation in networking" }, { "cve": "CVE-2020-15967", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885883" } ], "notes": [ { "category": "description", "text": "Use after free in payments in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in payments", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15967" }, { "category": "external", "summary": "RHBZ#1885883", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885883" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15967", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15967" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15967", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15967" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "chromium-browser: Use after free in payments" }, { "cve": "CVE-2020-15968", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885884" } ], "notes": [ { "category": "description", "text": "Use after free in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in Blink", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15968" }, { "category": "external", "summary": "RHBZ#1885884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885884" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15968", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15968" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15968", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15968" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in Blink" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" }, { "cve": "CVE-2020-15970", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885886" } ], "notes": [ { "category": "description", "text": "Use after free in NFC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in NFC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15970" }, { "category": "external", "summary": "RHBZ#1885886", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885886" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15970", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15970" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15970", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15970" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in NFC" }, { "cve": "CVE-2020-15971", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885887" } ], "notes": [ { "category": "description", "text": "Use after free in printing in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in printing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15971" }, { "category": "external", "summary": "RHBZ#1885887", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885887" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15971", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15971" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15971", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15971" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in printing" }, { "cve": "CVE-2020-15972", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885888" } ], "notes": [ { "category": "description", "text": "Use after free in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in audio", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15972" }, { "category": "external", "summary": "RHBZ#1885888", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885888" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15972", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15972" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15972", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15972" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in audio" }, { "cve": "CVE-2020-15973", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885891" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in extensions in Google Chrome prior to 86.0.4240.75 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient policy enforcement in extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15973" }, { "category": "external", "summary": "RHBZ#1885891", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885891" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15973", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15973" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15973", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15973" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient policy enforcement in extensions" }, { "cve": "CVE-2020-15974", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885892" } ], "notes": [ { "category": "description", "text": "Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in Blink", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15974" }, { "category": "external", "summary": "RHBZ#1885892", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885892" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15974", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15974" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15974", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15974" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Integer overflow in Blink" }, { "cve": "CVE-2020-15975", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885893" } ], "notes": [ { "category": "description", "text": "Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in SwiftShader", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15975" }, { "category": "external", "summary": "RHBZ#1885893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885893" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15975", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15975" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15975", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15975" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Integer overflow in SwiftShader" }, { "cve": "CVE-2020-15976", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885894" } ], "notes": [ { "category": "description", "text": "Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebXR", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15976" }, { "category": "external", "summary": "RHBZ#1885894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885894" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15976", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15976" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15976", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15976" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Use after free in WebXR" }, { "cve": "CVE-2020-15977", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885897" } ], "notes": [ { "category": "description", "text": "Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient data validation in dialogs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15977" }, { "category": "external", "summary": "RHBZ#1885897", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885897" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15977", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15977" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15977", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15977" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient data validation in dialogs" }, { "cve": "CVE-2020-15978", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885899" } ], "notes": [ { "category": "description", "text": "Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient data validation in navigation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15978" }, { "category": "external", "summary": "RHBZ#1885899", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885899" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15978", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15978" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15978", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15978" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient data validation in navigation" }, { "cve": "CVE-2020-15979", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885901" } ], "notes": [ { "category": "description", "text": "Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Inappropriate implementation in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15979" }, { "category": "external", "summary": "RHBZ#1885901", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885901" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15979", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15979" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15979", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15979" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Inappropriate implementation in V8" }, { "cve": "CVE-2020-15980", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885902" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Intents in Google Chrome on Android prior to 86.0.4240.75 allowed a local attacker to bypass navigation restrictions via crafted Intents.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient policy enforcement in Intents", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15980" }, { "category": "external", "summary": "RHBZ#1885902", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885902" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15980", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15980" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15980", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15980" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient policy enforcement in Intents" }, { "cve": "CVE-2020-15981", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885903" } ], "notes": [ { "category": "description", "text": "Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in audio", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15981" }, { "category": "external", "summary": "RHBZ#1885903", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885903" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15981", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15981" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15981", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15981" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in audio" }, { "cve": "CVE-2020-15982", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885904" } ], "notes": [ { "category": "description", "text": "Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Side-channel information leakage in cache", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15982" }, { "category": "external", "summary": "RHBZ#1885904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15982", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15982" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15982", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15982" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Side-channel information leakage in cache" }, { "cve": "CVE-2020-15983", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885905" } ], "notes": [ { "category": "description", "text": "Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient data validation in webUI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15983" }, { "category": "external", "summary": "RHBZ#1885905", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885905" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15983", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15983" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15983", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15983" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient data validation in webUI" }, { "cve": "CVE-2020-15984", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885906" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient policy enforcement in Omnibox", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15984" }, { "category": "external", "summary": "RHBZ#1885906", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885906" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15984", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15984" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15984", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15984" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient policy enforcement in Omnibox" }, { "cve": "CVE-2020-15985", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885907" } ], "notes": [ { "category": "description", "text": "Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Inappropriate implementation in Blink", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15985" }, { "category": "external", "summary": "RHBZ#1885907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885907" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15985", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15985" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15985", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15985" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Inappropriate implementation in Blink" }, { "cve": "CVE-2020-15986", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885908" } ], "notes": [ { "category": "description", "text": "Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in media", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15986" }, { "category": "external", "summary": "RHBZ#1885908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885908" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15986", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15986" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15986", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15986" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Integer overflow in media" }, { "cve": "CVE-2020-15987", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885909" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted WebRTC stream.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15987" }, { "category": "external", "summary": "RHBZ#1885909", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885909" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15987", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15987" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15987", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15987" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Use after free in WebRTC" }, { "cve": "CVE-2020-15988", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885911" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient policy enforcement in downloads", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15988" }, { "category": "external", "summary": "RHBZ#1885911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885911" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15988", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15988" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "chromium-browser: Insufficient policy enforcement in downloads" }, { "cve": "CVE-2020-15989", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885912" } ], "notes": [ { "category": "description", "text": "Uninitialized data in PDFium in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Uninitialized use in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15989" }, { "category": "external", "summary": "RHBZ#1885912", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885912" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15989", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15989" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15989", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15989" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "chromium-browser: Uninitialized use in PDFium" }, { "cve": "CVE-2020-15990", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885889" } ], "notes": [ { "category": "description", "text": "Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in autofill", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15990" }, { "category": "external", "summary": "RHBZ#1885889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885889" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15990", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15990" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15990", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15990" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in autofill" }, { "cve": "CVE-2020-15991", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885890" } ], "notes": [ { "category": "description", "text": "Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in password manager", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15991" }, { "category": "external", "summary": "RHBZ#1885890", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885890" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15991", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15991" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15991", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15991" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in password manager" }, { "cve": "CVE-2020-15992", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885910" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Insufficient policy enforcement in networking", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15992" }, { "category": "external", "summary": "RHBZ#1885910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15992", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15992" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15992", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15992" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-13T08:22:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4235" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:86.0.4240.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:86.0.4240.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Insufficient policy enforcement in networking" } ] }
rhsa-2020_4944
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 78.4.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4944", "url": "https://access.redhat.com/errata/RHSA-2020:4944" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4944.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T15:52:17+00:00", "generator": { "date": "2024-11-22T15:52:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4944", "initial_release_date": "2020-11-05T08:58:00+00:00", "revision_history": [ { "date": "2020-11-05T08:58:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-05T08:58:00+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:52:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.0::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_0.x86_64", "product": { "name": "thunderbird-0:78.4.0-1.el8_0.x86_64", "product_id": "thunderbird-0:78.4.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-0:78.4.0-1.el8_0.ppc64le", "product_id": "thunderbird-0:78.4.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_0.src", "product": { "name": "thunderbird-0:78.4.0-1.el8_0.src", "product_id": "thunderbird-0:78.4.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src" }, "product_reference": "thunderbird-0:78.4.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T08:58:00+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4944" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T08:58:00+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4944" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:thunderbird-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:thunderbird-debugsource-0:78.4.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4311
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 78.4.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4311", "url": "https://access.redhat.com/errata/RHSA-2020:4311" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4311.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T15:51:39+00:00", "generator": { "date": "2024-11-22T15:51:39+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4311", "initial_release_date": "2020-10-22T16:35:55+00:00", "revision_history": [ { "date": "2020-10-22T16:35:55+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-22T16:35:55+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:39+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product": { "name": "Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_e4s:8.0::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_0.x86_64", "product": { "name": "firefox-0:78.4.0-1.el8_0.x86_64", "product_id": "firefox-0:78.4.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_0.x86_64", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_0.x86_64", "product_id": "firefox-debugsource-0:78.4.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_0.ppc64le", "product": { "name": "firefox-0:78.4.0-1.el8_0.ppc64le", "product_id": "firefox-0:78.4.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "product_id": "firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_0.src", "product": { "name": "firefox-0:78.4.0-1.el8_0.src", "product_id": "firefox-0:78.4.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src" }, "product_reference": "firefox-0:78.4.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v. 8.0)", "product_id": "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z.E4S" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T16:35:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4311" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T16:35:55+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4311" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.src", "AppStream-8.0.0.Z.E4S:firefox-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debuginfo-0:78.4.0-1.el8_0.x86_64", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z.E4S:firefox-debugsource-0:78.4.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4315
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.1 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 78.4.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4315", "url": "https://access.redhat.com/errata/RHSA-2020:4315" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4315.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T15:51:24+00:00", "generator": { "date": "2024-11-22T15:51:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4315", "initial_release_date": "2020-10-22T17:39:51+00:00", "revision_history": [ { "date": "2020-10-22T17:39:51+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-22T17:39:51+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.1::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_1.s390x", "product": { "name": "firefox-0:78.4.0-1.el8_1.s390x", "product_id": "firefox-0:78.4.0-1.el8_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_1?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_1.s390x", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.s390x", "product_id": "firefox-debugsource-0:78.4.0-1.el8_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_1?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_1?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_1.x86_64", "product": { "name": "firefox-0:78.4.0-1.el8_1.x86_64", "product_id": "firefox-0:78.4.0-1.el8_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_1?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_1.x86_64", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.x86_64", "product_id": "firefox-debugsource-0:78.4.0-1.el8_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_1?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_1.ppc64le", "product": { "name": "firefox-0:78.4.0-1.el8_1.ppc64le", "product_id": "firefox-0:78.4.0-1.el8_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_1?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "product_id": "firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_1?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_1?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_1.aarch64", "product": { "name": "firefox-0:78.4.0-1.el8_1.aarch64", "product_id": "firefox-0:78.4.0-1.el8_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_1?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "product": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "product_id": "firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@78.4.0-1.el8_1?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "product_id": "firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el8_1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el8_1.src", "product": { "name": "firefox-0:78.4.0-1.el8_1.src", "product_id": "firefox-0:78.4.0-1.el8_1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el8_1?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64" }, "product_reference": "firefox-0:78.4.0-1.el8_1.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el8_1.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x" }, "product_reference": "firefox-0:78.4.0-1.el8_1.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_1.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src" }, "product_reference": "firefox-0:78.4.0-1.el8_1.src", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el8_1.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_1.s390x", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:78.4.0-1.el8_1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.1)", "product_id": "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" }, "product_reference": "firefox-debugsource-0:78.4.0-1.el8_1.x86_64", "relates_to_product_reference": "AppStream-8.1.0.Z.EUS" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T17:39:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4315" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T17:39:51+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4315" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.src", "AppStream-8.1.0.Z.EUS:firefox-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debuginfo-0:78.4.0-1.el8_1.x86_64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.aarch64", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.ppc64le", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.s390x", "AppStream-8.1.0.Z.EUS:firefox-debugsource-0:78.4.0-1.el8_1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4948
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 78.4.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4948", "url": "https://access.redhat.com/errata/RHSA-2020:4948" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4948.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T15:51:17+00:00", "generator": { "date": "2024-11-22T15:51:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4948", "initial_release_date": "2020-11-05T08:57:30+00:00", "revision_history": [ { "date": "2020-11-05T08:57:30+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-05T08:57:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.2::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_2.x86_64", "product": { "name": "thunderbird-0:78.4.0-1.el8_2.x86_64", "product_id": "thunderbird-0:78.4.0-1.el8_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_2?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_2?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_2?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_2.ppc64le", "product": { "name": "thunderbird-0:78.4.0-1.el8_2.ppc64le", "product_id": "thunderbird-0:78.4.0-1.el8_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_2?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_2?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_2?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_2.aarch64", "product": { "name": "thunderbird-0:78.4.0-1.el8_2.aarch64", "product_id": "thunderbird-0:78.4.0-1.el8_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_2?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "product": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "product_id": "thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@78.4.0-1.el8_2?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el8_2?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el8_2.src", "product": { "name": "thunderbird-0:78.4.0-1.el8_2.src", "product_id": "thunderbird-0:78.4.0-1.el8_2.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el8_2?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64" }, "product_reference": "thunderbird-0:78.4.0-1.el8_2.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el8_2.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_2.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src" }, "product_reference": "thunderbird-0:78.4.0-1.el8_2.src", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el8_2.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 8.2)", "product_id": "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" }, "product_reference": "thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64", "relates_to_product_reference": "AppStream-8.2.0.Z.EUS" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T08:57:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4948" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T08:57:30+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4948" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.src", "AppStream-8.2.0.Z.EUS:thunderbird-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debuginfo-0:78.4.0-1.el8_2.x86_64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.aarch64", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.ppc64le", "AppStream-8.2.0.Z.EUS:thunderbird-debugsource-0:78.4.0-1.el8_2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4909
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 78.4.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4909", "url": "https://access.redhat.com/errata/RHSA-2020:4909" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4909.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T15:51:54+00:00", "generator": { "date": "2024-11-22T15:51:54+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4909", "initial_release_date": "2020-11-04T14:28:10+00:00", "revision_history": [ { "date": "2020-11-04T14:28:10+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-04T14:28:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:54+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el7_9.x86_64", "product": { "name": "thunderbird-0:78.4.0-1.el7_9.x86_64", "product_id": "thunderbird-0:78.4.0-1.el7_9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el7_9?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el7_9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el7_9.src", "product": { "name": "thunderbird-0:78.4.0-1.el7_9.src", "product_id": "thunderbird-0:78.4.0-1.el7_9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el7_9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el7_9.ppc64le", "product": { "name": "thunderbird-0:78.4.0-1.el7_9.ppc64le", "product_id": "thunderbird-0:78.4.0-1.el7_9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el7_9?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el7_9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Workstation-7.9.Z" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T14:28:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4909" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T14:28:10+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4909" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:thunderbird-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:thunderbird-debuginfo-0:78.4.0-1.el7_9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4947
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 78.4.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4947", "url": "https://access.redhat.com/errata/RHSA-2020:4947" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4947.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T15:52:24+00:00", "generator": { "date": "2024-11-22T15:52:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4947", "initial_release_date": "2020-11-05T09:36:39+00:00", "revision_history": [ { "date": "2020-11-05T09:36:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-05T09:36:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:52:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el6_10.i686", "product": { "name": "thunderbird-0:78.4.0-1.el6_10.i686", "product_id": "thunderbird-0:78.4.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el6_10.x86_64", "product": { "name": "thunderbird-0:78.4.0-1.el6_10.x86_64", "product_id": "thunderbird-0:78.4.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el6_10.src", "product": { "name": "thunderbird-0:78.4.0-1.el6_10.src", "product_id": "thunderbird-0:78.4.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el6_10.ppc64", "product": { "name": "thunderbird-0:78.4.0-1.el6_10.ppc64", "product_id": "thunderbird-0:78.4.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:78.4.0-1.el6_10.s390x", "product": { "name": "thunderbird-0:78.4.0-1.el6_10.s390x", "product_id": "thunderbird-0:78.4.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@78.4.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "product": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "product_id": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@78.4.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:78.4.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:78.4.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T09:36:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4947" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-05T09:36:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4947" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:78.4.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:78.4.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4330
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 78.4.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4330", "url": "https://access.redhat.com/errata/RHSA-2020:4330" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4330.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T15:51:47+00:00", "generator": { "date": "2024-11-22T15:51:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4330", "initial_release_date": "2020-10-26T09:08:40+00:00", "revision_history": [ { "date": "2020-10-26T09:08:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-26T09:08:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-2.el6_10.i686", "product": { "name": "firefox-0:78.4.0-2.el6_10.i686", "product_id": "firefox-0:78.4.0-2.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-2.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-2.el6_10.x86_64", "product": { "name": "firefox-0:78.4.0-2.el6_10.x86_64", "product_id": "firefox-0:78.4.0-2.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-2.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "product": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "product_id": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-2.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-2.el6_10.src", "product": { "name": "firefox-0:78.4.0-2.el6_10.src", "product_id": "firefox-0:78.4.0-2.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-2.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-2.el6_10.ppc64", "product": { "name": "firefox-0:78.4.0-2.el6_10.ppc64", "product_id": "firefox-0:78.4.0-2.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-2.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "product": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "product_id": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-2.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-2.el6_10.s390x", "product": { "name": "firefox-0:78.4.0-2.el6_10.s390x", "product_id": "firefox-0:78.4.0-2.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-2.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "product": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "product_id": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-2.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686" }, "product_reference": "firefox-0:78.4.0-2.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src" }, "product_reference": "firefox-0:78.4.0-2.el6_10.src", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-26T09:08:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4330" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-26T09:08:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4330" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Client-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Server-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:78.4.0-2.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:78.4.0-2.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
rhsa-2020_4310
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 78.4.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4310", "url": "https://access.redhat.com/errata/RHSA-2020:4310" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4310.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T15:51:17+00:00", "generator": { "date": "2024-11-22T15:51:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4310", "initial_release_date": "2020-10-22T17:24:03+00:00", "revision_history": [ { "date": "2020-10-22T17:24:03+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-10-22T17:24:03+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:51:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el7_9.x86_64", "product": { "name": "firefox-0:78.4.0-1.el7_9.x86_64", "product_id": "firefox-0:78.4.0-1.el7_9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el7_9?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "product_id": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el7_9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el7_9.src", "product": { "name": "firefox-0:78.4.0-1.el7_9.src", "product_id": "firefox-0:78.4.0-1.el7_9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el7_9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el7_9.i686", "product": { "name": "firefox-0:78.4.0-1.el7_9.i686", "product_id": "firefox-0:78.4.0-1.el7_9.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el7_9?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el7_9.s390x", "product": { "name": "firefox-0:78.4.0-1.el7_9.s390x", "product_id": "firefox-0:78.4.0-1.el7_9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el7_9?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "product_id": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el7_9?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el7_9.ppc64", "product": { "name": "firefox-0:78.4.0-1.el7_9.ppc64", "product_id": "firefox-0:78.4.0-1.el7_9.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el7_9?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "product_id": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el7_9?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:78.4.0-1.el7_9.ppc64le", "product": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le", "product_id": "firefox-0:78.4.0-1.el7_9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@78.4.0-1.el7_9?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "product": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "product_id": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@78.4.0-1.el7_9?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686" }, "product_reference": "firefox-0:78.4.0-1.el7_9.i686", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src" }, "product_reference": "firefox-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Client-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686" }, "product_reference": "firefox-0:78.4.0-1.el7_9.i686", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src" }, "product_reference": "firefox-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Client-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686" }, "product_reference": "firefox-0:78.4.0-1.el7_9.i686", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src" }, "product_reference": "firefox-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Server-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686" }, "product_reference": "firefox-0:78.4.0-1.el7_9.i686", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src" }, "product_reference": "firefox-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Server-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686" }, "product_reference": "firefox-0:78.4.0-1.el7_9.i686", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src" }, "product_reference": "firefox-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Workstation-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686" }, "product_reference": "firefox-0:78.4.0-1.el7_9.i686", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src" }, "product_reference": "firefox-0:78.4.0-1.el7_9.src", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "relates_to_product_reference": "7Workstation-optional-7.9.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" }, "product_reference": "firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "relates_to_product_reference": "7Workstation-optional-7.9.Z" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Philipp", "Simon Giesecke", "Christian Holler", "Jason Kratzer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-15683", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2020-10-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1889932" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR \u003c 78.4, Firefox \u003c 82, and Thunderbird \u003c 78.4.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15683" }, { "category": "external", "summary": "RHBZ#1889932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889932" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15683", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15683" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15683" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2020-46/#CVE-2020-15683" } ], "release_date": "2020-10-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T17:24:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4" }, { "cve": "CVE-2020-15969", "discovery_date": "2020-10-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1885885" } ], "notes": [ { "category": "description", "text": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebRTC", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15969" }, { "category": "external", "summary": "RHBZ#1885885", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1885885" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" } ], "release_date": "2020-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-10-22T17:24:03+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Client-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Client-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Server-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Server-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.i686", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.src", "7Workstation-optional-7.9.Z:firefox-0:78.4.0-1.el7_9.x86_64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.ppc64le", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.s390x", "7Workstation-optional-7.9.Z:firefox-debuginfo-0:78.4.0-1.el7_9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebRTC" } ] }
gsd-2020-15969
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2020-15969", "description": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "id": "GSD-2020-15969", "references": [ "https://www.suse.com/security/cve/CVE-2020-15969.html", "https://www.debian.org/security/2021/dsa-4824", "https://www.debian.org/security/2020/dsa-4780", "https://www.debian.org/security/2020/dsa-4778", "https://access.redhat.com/errata/RHSA-2020:4948", "https://access.redhat.com/errata/RHSA-2020:4947", "https://access.redhat.com/errata/RHSA-2020:4945", "https://access.redhat.com/errata/RHSA-2020:4944", "https://access.redhat.com/errata/RHSA-2020:4913", "https://access.redhat.com/errata/RHSA-2020:4909", "https://access.redhat.com/errata/RHSA-2020:4330", "https://access.redhat.com/errata/RHSA-2020:4317", "https://access.redhat.com/errata/RHSA-2020:4315", "https://access.redhat.com/errata/RHSA-2020:4311", "https://access.redhat.com/errata/RHSA-2020:4310", "https://access.redhat.com/errata/RHSA-2020:4235", "https://ubuntu.com/security/CVE-2020-15969", "https://advisories.mageia.org/CVE-2020-15969.html", "https://security.archlinux.org/CVE-2020-15969", "https://linux.oracle.com/cve/CVE-2020-15969.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-15969" ], "details": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "id": "GSD-2020-15969", "modified": "2023-12-13T01:21:43.442476Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "chrome-cve-admin@google.com", "ID": "CVE-2020-15969", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Chrome", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "86.0.4240.75" } ] } } ] }, "vendor_name": "Google" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Use after free" } ] } ] }, "references": { "reference_data": [ { "name": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "refsource": "MISC", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "name": "https://crbug.com/1124659", "refsource": "MISC", "url": "https://crbug.com/1124659" }, { "name": "openSUSE-SU-2020:1829", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "name": "FEDORA-2020-127d40f1ab", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/" }, { "name": "FEDORA-2020-8aca25b5c8", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/" }, { "name": "FEDORA-2020-4e8e48da22", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/" }, { "name": "https://support.apple.com/kb/HT212009", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212009" }, { "name": "https://support.apple.com/kb/HT212011", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212011" }, { "name": "https://support.apple.com/kb/HT212005", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212005" }, { "name": "https://support.apple.com/kb/HT212003", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212003" }, { "name": "https://support.apple.com/kb/HT212007", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212007" }, { "name": "20201215 APPLE-SA-2020-12-14-5 watchOS 7.2", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/27" }, { "name": "20201215 APPLE-SA-2020-12-14-8 Safari 14.0.2", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/30" }, { "name": "20201215 APPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/24" }, { "name": "20201215 APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/26" }, { "name": "20201215 APPLE-SA-2020-12-14-7 tvOS 14.3", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2020/Dec/29" }, { "name": "DSA-4824", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2021/dsa-4824" }, { "name": "GLSA-202101-30", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202101-30" } ] } }, "mozilla.org": { "CVE_data_meta": { "ASSIGNER": "security@mozilla.org", "ID": "CVE-2020-15969" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Firefox ESR", "version": { "version_data": [ { "version_affected": "\u003c", "version_value": "78.4" } ] } } ] }, "vendor_name": "Mozilla" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A use-after-free bug in the usersctp library was reported upstream. We assume this could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 78.4." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Use-after-free in usersctp" } ] } ] }, "references": { "reference_data": [ { "url": "https://www.mozilla.org/security/advisories/mfsa2020-46/" }, { "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1666570" }, { "url": "https://github.com/sctplab/usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "86.0.4240.75", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "14.0.2", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "14.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "14.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "11.1", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "14.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "7.2", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "chrome-cve-admin@google.com", "ID": "CVE-2020-15969" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-787" }, { "lang": "en", "value": "CWE-416" } ] } ] }, "references": { "reference_data": [ { "name": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html", "refsource": "MISC", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "name": "https://crbug.com/1124659", "refsource": "MISC", "tags": [ "Permissions Required", "Vendor Advisory" ], "url": "https://crbug.com/1124659" }, { "name": "openSUSE-SU-2020:1829", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "name": "FEDORA-2020-127d40f1ab", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/" }, { "name": "FEDORA-2020-8aca25b5c8", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/" }, { "name": "FEDORA-2020-4e8e48da22", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/" }, { "name": "https://support.apple.com/kb/HT212009", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT212009" }, { "name": "https://support.apple.com/kb/HT212007", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT212007" }, { "name": "https://support.apple.com/kb/HT212005", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT212005" }, { "name": "https://support.apple.com/kb/HT212003", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT212003" }, { "name": "https://support.apple.com/kb/HT212011", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://support.apple.com/kb/HT212011" }, { "name": "20201215 APPLE-SA-2020-12-14-8 Safari 14.0.2", "refsource": "FULLDISC", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/30" }, { "name": "20201215 APPLE-SA-2020-12-14-7 tvOS 14.3", "refsource": "FULLDISC", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/29" }, { "name": "20201215 APPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3", "refsource": "FULLDISC", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/24" }, { "name": "20201215 APPLE-SA-2020-12-14-5 watchOS 7.2", "refsource": "FULLDISC", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/27" }, { "name": "20201215 APPLE-SA-2020-12-14-3 macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave", "refsource": "FULLDISC", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://seclists.org/fulldisclosure/2020/Dec/26" }, { "name": "DSA-4824", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2021/dsa-4824" }, { "name": "GLSA-202101-30", "refsource": "GENTOO", "tags": [ "Third Party Advisory" ], "url": "https://security.gentoo.org/glsa/202101-30" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 5.9 } }, "lastModifiedDate": "2021-07-21T11:39Z", "publishedDate": "2020-11-03T03:15Z" } } }
var-202011-0444
Vulnerability from variot
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chrome has security holes. 6) - i386, x86_64
- Description:
Mozilla Thunderbird is a standalone mail and newsgroup client. 8.0) - aarch64, ppc64le, s390x, x86_64
Background
Library for rendering dynamic web content in Qt5 C++ and QML applications. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3
iOS 14.3 and iPadOS 14.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212003.
App Store Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: An enterprise application installation prompt may display the wrong domain Description: A logic issue was addressed with improved state management. CVE-2020-29613: Ryan Pickren (ryanpickren.com)
CoreAudio Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-27948: JunDong Xie of Ant Security Light-Year Lab
FontParser Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted font may result in the disclosure of process memory Description: An information disclosure issue was addressed with improved state management. CVE-2020-27946: Mateusz Jurczyk of Google Project Zero
FontParser Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed with improved input validation. CVE-2020-27943: Mateusz Jurczyk of Google Project Zero CVE-2020-27944: Mateusz Jurczyk of Google Project Zero
ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted image may lead to heap corruption Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-29617: XingWei Lin of Ant Security Light-Year Lab CVE-2020-29619: XingWei Lin of Ant Security Light-Year Lab
ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2020-29618: XingWei Lin of Ant Security Light-Year Lab
ImageIO Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing a maliciously crafted image may lead to arbitrary code execution Description: An out-of-bounds write issue was addressed with improved bounds checking. CVE-2020-29611: Ivan Fratric of Google Project Zero
Security Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Unauthorized code execution may lead to an authentication policy violation Description: This issue was addressed with improved checks. CVE-2020-27951: Apple
WebRTC Available for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch (7th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2020-15969: an anonymous researcher
Installation note:
This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
- Navigate to Settings
- Select General
- Select About. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202010-01
https://security.gentoo.org/
Severity: Normal Title: Chromium, Google Chrome: Multiple vulnerabilities Date: October 17, 2020 Bugs: #747013 ID: 202010-01
Synopsis
Multiple vulnerabilities have been found in Chromium and Google Chrome, the worst of which could result in the arbitrary execution of code.
Background
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
Google Chrome is one fast, simple, and secure browser for all your devices.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 www-client/chromium < 86.0.4240.75 >= 86.0.4240.75 2 www-client/google-chrome < 86.0.4240.75 >= 86.0.4240.75 ------------------------------------------------------------------- 2 affected packages
Description
Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All Chromium users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=www-client/chromium-86.0.4240.75"
All Google Chrome users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot -v ">=www-client/google-chrome-86.0.4240.75"
References
[ 1 ] CVE-2020-15967 https://nvd.nist.gov/vuln/detail/CVE-2020-15967 [ 2 ] CVE-2020-15968 https://nvd.nist.gov/vuln/detail/CVE-2020-15968 [ 3 ] CVE-2020-15969 https://nvd.nist.gov/vuln/detail/CVE-2020-15969 [ 4 ] CVE-2020-15970 https://nvd.nist.gov/vuln/detail/CVE-2020-15970 [ 5 ] CVE-2020-15971 https://nvd.nist.gov/vuln/detail/CVE-2020-15971 [ 6 ] CVE-2020-15972 https://nvd.nist.gov/vuln/detail/CVE-2020-15972 [ 7 ] CVE-2020-15973 https://nvd.nist.gov/vuln/detail/CVE-2020-15973 [ 8 ] CVE-2020-15974 https://nvd.nist.gov/vuln/detail/CVE-2020-15974 [ 9 ] CVE-2020-15975 https://nvd.nist.gov/vuln/detail/CVE-2020-15975 [ 10 ] CVE-2020-15976 https://nvd.nist.gov/vuln/detail/CVE-2020-15976 [ 11 ] CVE-2020-15977 https://nvd.nist.gov/vuln/detail/CVE-2020-15977 [ 12 ] CVE-2020-15978 https://nvd.nist.gov/vuln/detail/CVE-2020-15978 [ 13 ] CVE-2020-15979 https://nvd.nist.gov/vuln/detail/CVE-2020-15979 [ 14 ] CVE-2020-15980 https://nvd.nist.gov/vuln/detail/CVE-2020-15980 [ 15 ] CVE-2020-15981 https://nvd.nist.gov/vuln/detail/CVE-2020-15981 [ 16 ] CVE-2020-15982 https://nvd.nist.gov/vuln/detail/CVE-2020-15982 [ 17 ] CVE-2020-15983 https://nvd.nist.gov/vuln/detail/CVE-2020-15983 [ 18 ] CVE-2020-15984 https://nvd.nist.gov/vuln/detail/CVE-2020-15984 [ 19 ] CVE-2020-15985 https://nvd.nist.gov/vuln/detail/CVE-2020-15985 [ 20 ] CVE-2020-15986 https://nvd.nist.gov/vuln/detail/CVE-2020-15986 [ 21 ] CVE-2020-15987 https://nvd.nist.gov/vuln/detail/CVE-2020-15987 [ 22 ] CVE-2020-15988 https://nvd.nist.gov/vuln/detail/CVE-2020-15988 [ 23 ] CVE-2020-15989 https://nvd.nist.gov/vuln/detail/CVE-2020-15989 [ 24 ] CVE-2020-15990 https://nvd.nist.gov/vuln/detail/CVE-2020-15990 [ 25 ] CVE-2020-15991 https://nvd.nist.gov/vuln/detail/CVE-2020-15991 [ 26 ] CVE-2020-15992 https://nvd.nist.gov/vuln/detail/CVE-2020-15992 [ 27 ] CVE-2020-6557 https://nvd.nist.gov/vuln/detail/CVE-2020-6557
Availability
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202010-01
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License
Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. 8.2) - aarch64, ppc64le, x86_64
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: firefox security update Advisory ID: RHSA-2020:4310-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:4310 Issue date: 2020-10-22 CVE Names: CVE-2020-15683 CVE-2020-15969 ==================================================================== 1. Summary:
An update for firefox is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
- Description:
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 78.4.0 ESR.
Security Fix(es):
-
Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4 (CVE-2020-15683)
-
chromium-browser: Use after free in WebRTC (CVE-2020-15969)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Firefox must be restarted for the changes to take effect.
- Bugs fixed (https://bugzilla.redhat.com/):
1885885 - CVE-2020-15969 chromium-browser: Use after free in WebRTC 1889932 - CVE-2020-15683 Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source: firefox-78.4.0-1.el7_9.src.rpm
x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64: firefox-78.4.0-1.el7_9.i686.rpm
Red Hat Enterprise Linux Server (v. 7):
Source: firefox-78.4.0-1.el7_9.src.rpm
ppc64: firefox-78.4.0-1.el7_9.ppc64.rpm firefox-debuginfo-78.4.0-1.el7_9.ppc64.rpm
ppc64le: firefox-78.4.0-1.el7_9.ppc64le.rpm firefox-debuginfo-78.4.0-1.el7_9.ppc64le.rpm
s390x: firefox-78.4.0-1.el7_9.s390x.rpm firefox-debuginfo-78.4.0-1.el7_9.s390x.rpm
x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
x86_64: firefox-78.4.0-1.el7_9.i686.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source: firefox-78.4.0-1.el7_9.src.rpm
x86_64: firefox-78.4.0-1.el7_9.x86_64.rpm firefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64: firefox-78.4.0-1.el7_9.i686.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2020-15683 https://access.redhat.com/security/cve/CVE-2020-15969 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBX5G+ntzjgjWX9erEAQhmDQ//dHDny/ImuLP8xvK4PtLEY7BRvrOS/vY2 YkKEGdGOQa48sBw+5Y2tSqra5gKOqf5H3lcxj+sTG97hUStgrNAucZpTHaKm7vde /Eb3PIFWOqnNpcvDg6njU/q5ttA7YC0PHizRfH0Yix5EUAkKZnMWlcS8Lkm5FEM2 Ws+UfvgB/+Gx03I2MioDwnnHnnZLR+pmt7EYl7CnKLRMYsQVEkrlc2b7gCzPlijo UV91wcUoX4s9/v/i2afTY8CqhDs8MNHFnsVX+FTCyGbezamAxJ+YTKtDgKDiG+7v up2fIlMhf8eKnkEpyOebDDPo8vECJr311rXT0qg6/jkx9iogOyHskOcmTYIK5xzT R9gmF+gvsJsMeHzD6a6uh5BsLLS7rtIESWO91IS0FofOAv0lkkOqG1xlAq4zAKYc 8NrzZ0omzrB9rRK2LeKp2oAP0xIoFQiTmicoBAvRijNPRSWT8SZY/IfOsSvrbfkG rGOY4nNaLVQUqXv7+BKa/LusfBhQkGgxcKO/uNX7xWGTEqH4ysx7/ELKmQ1LjZxw bgYhrYaSkSMAQ5r/Nf0qMHLLxvMUqmJmgkExE0rLwogxWVYZWVCiIwI0wncDCFEo mw8HZ58JlTWTv2owGc8I0fo+ln7Y5xmuXuyN6AldueladP0AdtdNyaw/GHquCytW o2ukWK2zUE8=oczW -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202011-0444", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "33" }, { "model": "watchos", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "7.2" }, { "model": "backports sle", "scope": "eq", "trust": 1.0, "vendor": "opensuse", "version": "15.0" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "31" }, { "model": "linux", "scope": "eq", "trust": 1.0, "vendor": "debian", "version": "10.0" }, { "model": "macos", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "11.1" }, { "model": "fedora", "scope": "eq", "trust": 1.0, "vendor": "fedoraproject", "version": "32" }, { "model": "tvos", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "14.3" }, { "model": "ipados", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "14.3" }, { "model": "chrome", "scope": "lt", "trust": 1.0, "vendor": "google", "version": "86.0.4240.75" }, { "model": "safari", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "14.0.2" }, { "model": "iphone os", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "14.3" } ], "sources": [ { "db": "NVD", "id": "CVE-2020-15969" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Red Hat", "sources": [ { "db": "PACKETSTORM", "id": "159910" }, { "db": "PACKETSTORM", "id": "159679" }, { "db": "PACKETSTORM", "id": "159906" }, { "db": "PACKETSTORM", "id": "159682" } ], "trust": 0.4 }, "cve": "CVE-2020-15969", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CVE-2020-15969", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 1.0, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "VHN-169000", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.8, "id": "CVE-2020-15969", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2020-15969", "trust": 1.0, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-169000", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-169000" }, { "db": "NVD", "id": "CVE-2020-15969" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chrome has security holes. 6) - i386, x86_64\n\n3. Description:\n\nMozilla Thunderbird is a standalone mail and newsgroup client. 8.0) - aarch64, ppc64le, s390x, x86_64\n\n3. \n\nBackground\n=========\nLibrary for rendering dynamic web content in Qt5 C++ and QML\napplications. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2020-12-14-1 iOS 14.3 and iPadOS 14.3\n\niOS 14.3 and iPadOS 14.3 addresses the following issues. \nInformation about the security content is also available at\nhttps://support.apple.com/HT212003. \n\nApp Store\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: An enterprise application installation prompt may display the\nwrong domain\nDescription: A logic issue was addressed with improved state\nmanagement. \nCVE-2020-29613: Ryan Pickren (ryanpickren.com)\n\nCoreAudio\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing a maliciously crafted audio file may lead to\narbitrary code execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2020-27948: JunDong Xie of Ant Security Light-Year Lab\n\nFontParser\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing a maliciously crafted font may result in the\ndisclosure of process memory\nDescription: An information disclosure issue was addressed with\nimproved state management. \nCVE-2020-27946: Mateusz Jurczyk of Google Project Zero\n\nFontParser\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing a maliciously crafted font file may lead to\narbitrary code execution\nDescription: A memory corruption issue existed in the processing of\nfont files. This issue was addressed with improved input validation. \nCVE-2020-27943: Mateusz Jurczyk of Google Project Zero\nCVE-2020-27944: Mateusz Jurczyk of Google Project Zero\n\nImageIO\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing a maliciously crafted image may lead to heap\ncorruption\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-29617: XingWei Lin of Ant Security Light-Year Lab\nCVE-2020-29619: XingWei Lin of Ant Security Light-Year Lab\n\nImageIO\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2020-29618: XingWei Lin of Ant Security Light-Year Lab\n\nImageIO\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing a maliciously crafted image may lead to arbitrary\ncode execution\nDescription: An out-of-bounds write issue was addressed with improved\nbounds checking. \nCVE-2020-29611: Ivan Fratric of Google Project Zero\n\nSecurity\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Unauthorized code execution may lead to an authentication\npolicy violation\nDescription: This issue was addressed with improved checks. \nCVE-2020-27951: Apple\n\nWebRTC\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4\nand later, and iPod touch (7th generation)\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2020-15969: an anonymous researcher\n\nInstallation note:\n\nThis update is available through iTunes and Software Update on your\niOS device, and will not appear in your computer\u0027s Software Update\napplication, or in the Apple Downloads site. Make sure you have an\nInternet connection and have installed the latest version of iTunes\nfrom https://www.apple.com/itunes/\n\niTunes and Software Update on the device will automatically check\nApple\u0027s update server on its weekly schedule. When an update is\ndetected, it is downloaded and the option to be installed is\npresented to the user when the iOS device is docked. We recommend\napplying the update immediately if possible. Selecting Don\u0027t Install\nwill present the option the next time you connect your iOS device. \n\nThe automatic update process may take up to a week depending on the\nday that iTunes or the device checks for updates. You may manually\nobtain the update via the Check for Updates button within iTunes, or\nthe Software Update on your device. \n\nTo check that the iPhone, iPod touch, or iPad has been updated:\n\n* Navigate to Settings\n* Select General\n* Select About. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory GLSA 202010-01\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n Title: Chromium, Google Chrome: Multiple vulnerabilities\n Date: October 17, 2020\n Bugs: #747013\n ID: 202010-01\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Chromium and Google Chrome,\nthe worst of which could result in the arbitrary execution of code. \n\nBackground\n==========\n\nChromium is an open-source browser project that aims to build a safer,\nfaster, and more stable way for all users to experience the web. \n\nGoogle Chrome is one fast, simple, and secure browser for all your\ndevices. \n\nAffected packages\n=================\n\n -------------------------------------------------------------------\n Package / Vulnerable / Unaffected\n -------------------------------------------------------------------\n 1 www-client/chromium \u003c 86.0.4240.75 \u003e= 86.0.4240.75\n 2 www-client/google-chrome\n \u003c 86.0.4240.75 \u003e= 86.0.4240.75\n -------------------------------------------------------------------\n 2 affected packages\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Chromium and Google\nChrome. Please review the CVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Chromium users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \"\u003e=www-client/chromium-86.0.4240.75\"\n\nAll Google Chrome users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot -v \"\u003e=www-client/google-chrome-86.0.4240.75\"\n\nReferences\n==========\n\n[ 1 ] CVE-2020-15967\n https://nvd.nist.gov/vuln/detail/CVE-2020-15967\n[ 2 ] CVE-2020-15968\n https://nvd.nist.gov/vuln/detail/CVE-2020-15968\n[ 3 ] CVE-2020-15969\n https://nvd.nist.gov/vuln/detail/CVE-2020-15969\n[ 4 ] CVE-2020-15970\n https://nvd.nist.gov/vuln/detail/CVE-2020-15970\n[ 5 ] CVE-2020-15971\n https://nvd.nist.gov/vuln/detail/CVE-2020-15971\n[ 6 ] CVE-2020-15972\n https://nvd.nist.gov/vuln/detail/CVE-2020-15972\n[ 7 ] CVE-2020-15973\n https://nvd.nist.gov/vuln/detail/CVE-2020-15973\n[ 8 ] CVE-2020-15974\n https://nvd.nist.gov/vuln/detail/CVE-2020-15974\n[ 9 ] CVE-2020-15975\n https://nvd.nist.gov/vuln/detail/CVE-2020-15975\n[ 10 ] CVE-2020-15976\n https://nvd.nist.gov/vuln/detail/CVE-2020-15976\n[ 11 ] CVE-2020-15977\n https://nvd.nist.gov/vuln/detail/CVE-2020-15977\n[ 12 ] CVE-2020-15978\n https://nvd.nist.gov/vuln/detail/CVE-2020-15978\n[ 13 ] CVE-2020-15979\n https://nvd.nist.gov/vuln/detail/CVE-2020-15979\n[ 14 ] CVE-2020-15980\n https://nvd.nist.gov/vuln/detail/CVE-2020-15980\n[ 15 ] CVE-2020-15981\n https://nvd.nist.gov/vuln/detail/CVE-2020-15981\n[ 16 ] CVE-2020-15982\n https://nvd.nist.gov/vuln/detail/CVE-2020-15982\n[ 17 ] CVE-2020-15983\n https://nvd.nist.gov/vuln/detail/CVE-2020-15983\n[ 18 ] CVE-2020-15984\n https://nvd.nist.gov/vuln/detail/CVE-2020-15984\n[ 19 ] CVE-2020-15985\n https://nvd.nist.gov/vuln/detail/CVE-2020-15985\n[ 20 ] CVE-2020-15986\n https://nvd.nist.gov/vuln/detail/CVE-2020-15986\n[ 21 ] CVE-2020-15987\n https://nvd.nist.gov/vuln/detail/CVE-2020-15987\n[ 22 ] CVE-2020-15988\n https://nvd.nist.gov/vuln/detail/CVE-2020-15988\n[ 23 ] CVE-2020-15989\n https://nvd.nist.gov/vuln/detail/CVE-2020-15989\n[ 24 ] CVE-2020-15990\n https://nvd.nist.gov/vuln/detail/CVE-2020-15990\n[ 25 ] CVE-2020-15991\n https://nvd.nist.gov/vuln/detail/CVE-2020-15991\n[ 26 ] CVE-2020-15992\n https://nvd.nist.gov/vuln/detail/CVE-2020-15992\n[ 27 ] CVE-2020-6557\n https://nvd.nist.gov/vuln/detail/CVE-2020-6557\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202010-01\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2020 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n\n. 8.2) - aarch64, ppc64le, x86_64\n\n3. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Important: firefox security update\nAdvisory ID: RHSA-2020:4310-01\nProduct: Red Hat Enterprise Linux\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:4310\nIssue date: 2020-10-22\nCVE Names: CVE-2020-15683 CVE-2020-15969\n====================================================================\n1. Summary:\n\nAn update for firefox is now available for Red Hat Enterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux Client (v. 7) - x86_64\nRed Hat Enterprise Linux Client Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux Server Optional (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation (v. 7) - x86_64\nRed Hat Enterprise Linux Workstation Optional (v. 7) - x86_64\n\n3. Description:\n\nMozilla Firefox is an open-source web browser, designed for standards\ncompliance, performance, and portability. \n\nThis update upgrades Firefox to version 78.4.0 ESR. \n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4\n(CVE-2020-15683)\n\n* chromium-browser: Use after free in WebRTC (CVE-2020-15969)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to\ntake effect. \n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1885885 - CVE-2020-15969 chromium-browser: Use after free in WebRTC\n1889932 - CVE-2020-15683 Mozilla: Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4\n\n6. Package List:\n\nRed Hat Enterprise Linux Client (v. 7):\n\nSource:\nfirefox-78.4.0-1.el7_9.src.rpm\n\nx86_64:\nfirefox-78.4.0-1.el7_9.x86_64.rpm\nfirefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Client Optional (v. 7):\n\nx86_64:\nfirefox-78.4.0-1.el7_9.i686.rpm\n\nRed Hat Enterprise Linux Server (v. 7):\n\nSource:\nfirefox-78.4.0-1.el7_9.src.rpm\n\nppc64:\nfirefox-78.4.0-1.el7_9.ppc64.rpm\nfirefox-debuginfo-78.4.0-1.el7_9.ppc64.rpm\n\nppc64le:\nfirefox-78.4.0-1.el7_9.ppc64le.rpm\nfirefox-debuginfo-78.4.0-1.el7_9.ppc64le.rpm\n\ns390x:\nfirefox-78.4.0-1.el7_9.s390x.rpm\nfirefox-debuginfo-78.4.0-1.el7_9.s390x.rpm\n\nx86_64:\nfirefox-78.4.0-1.el7_9.x86_64.rpm\nfirefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Server Optional (v. 7):\n\nx86_64:\nfirefox-78.4.0-1.el7_9.i686.rpm\n\nRed Hat Enterprise Linux Workstation (v. 7):\n\nSource:\nfirefox-78.4.0-1.el7_9.src.rpm\n\nx86_64:\nfirefox-78.4.0-1.el7_9.x86_64.rpm\nfirefox-debuginfo-78.4.0-1.el7_9.x86_64.rpm\n\nRed Hat Enterprise Linux Workstation Optional (v. 7):\n\nx86_64:\nfirefox-78.4.0-1.el7_9.i686.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-15683\nhttps://access.redhat.com/security/cve/CVE-2020-15969\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBX5G+ntzjgjWX9erEAQhmDQ//dHDny/ImuLP8xvK4PtLEY7BRvrOS/vY2\nYkKEGdGOQa48sBw+5Y2tSqra5gKOqf5H3lcxj+sTG97hUStgrNAucZpTHaKm7vde\n/Eb3PIFWOqnNpcvDg6njU/q5ttA7YC0PHizRfH0Yix5EUAkKZnMWlcS8Lkm5FEM2\nWs+UfvgB/+Gx03I2MioDwnnHnnZLR+pmt7EYl7CnKLRMYsQVEkrlc2b7gCzPlijo\nUV91wcUoX4s9/v/i2afTY8CqhDs8MNHFnsVX+FTCyGbezamAxJ+YTKtDgKDiG+7v\nup2fIlMhf8eKnkEpyOebDDPo8vECJr311rXT0qg6/jkx9iogOyHskOcmTYIK5xzT\nR9gmF+gvsJsMeHzD6a6uh5BsLLS7rtIESWO91IS0FofOAv0lkkOqG1xlAq4zAKYc\n8NrzZ0omzrB9rRK2LeKp2oAP0xIoFQiTmicoBAvRijNPRSWT8SZY/IfOsSvrbfkG\nrGOY4nNaLVQUqXv7+BKa/LusfBhQkGgxcKO/uNX7xWGTEqH4ysx7/ELKmQ1LjZxw\nbgYhrYaSkSMAQ5r/Nf0qMHLLxvMUqmJmgkExE0rLwogxWVYZWVCiIwI0wncDCFEo\nmw8HZ58JlTWTv2owGc8I0fo+ln7Y5xmuXuyN6AldueladP0AdtdNyaw/GHquCytW\no2ukWK2zUE8=oczW\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n", "sources": [ { "db": "NVD", "id": "CVE-2020-15969" }, { "db": "VULHUB", "id": "VHN-169000" }, { "db": "PACKETSTORM", "id": "159910" }, { "db": "PACKETSTORM", "id": "159679" }, { "db": "PACKETSTORM", "id": "160542" }, { "db": "PACKETSTORM", "id": "161131" }, { "db": "PACKETSTORM", "id": "160536" }, { "db": "PACKETSTORM", "id": "159587" }, { "db": "PACKETSTORM", "id": "159906" }, { "db": "PACKETSTORM", "id": "159746" }, { "db": "PACKETSTORM", "id": "159682" } ], "trust": 1.8 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2020-15969", "trust": 2.1 }, { "db": "PACKETSTORM", "id": "159910", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "161131", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "159679", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "159906", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "160536", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "159587", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "160542", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "159746", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "159682", "trust": 0.2 }, { "db": "PACKETSTORM", "id": "159893", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159683", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159909", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "160538", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "160543", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159695", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159536", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159907", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "160540", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159888", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "159686", "trust": 0.1 }, { "db": "VULHUB", "id": "VHN-169000", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "168970", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-169000" }, { "db": "PACKETSTORM", "id": "168970" }, { "db": "PACKETSTORM", "id": "159910" }, { "db": "PACKETSTORM", "id": "159679" }, { "db": "PACKETSTORM", "id": "160542" }, { "db": "PACKETSTORM", "id": "161131" }, { "db": "PACKETSTORM", "id": "160536" }, { "db": "PACKETSTORM", "id": "159587" }, { "db": "PACKETSTORM", "id": "159906" }, { "db": "PACKETSTORM", "id": "159746" }, { "db": "PACKETSTORM", "id": "159682" }, { "db": "NVD", "id": "CVE-2020-15969" } ] }, "id": "VAR-202011-0444", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-169000" } ], "trust": 0.01 }, "last_update_date": "2024-11-29T21:05:43.894000Z", "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-416", "trust": 1.1 }, { "problemtype": "CWE-787", "trust": 1.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-169000" }, { "db": "NVD", "id": "CVE-2020-15969" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.2, "url": "https://security.gentoo.org/glsa/202101-30" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht212003" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht212005" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht212007" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht212009" }, { "trust": 1.1, "url": "https://support.apple.com/kb/ht212011" }, { "trust": 1.1, "url": "https://www.debian.org/security/2021/dsa-4824" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2020/dec/24" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2020/dec/26" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2020/dec/27" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2020/dec/29" }, { "trust": 1.1, "url": "http://seclists.org/fulldisclosure/2020/dec/30" }, { "trust": 1.1, "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "trust": 1.1, "url": "https://crbug.com/1124659" }, { "trust": 1.1, "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "trust": 1.0, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15969" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4gwcwnhttyoh6hsfuxpgpbb6j6jyzhze/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24qfl4c3azkmfvl7lvsymu2dne5vvugs/" }, { "trust": 1.0, "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/sc3u3h6aisvzb5plzllnf4hmq4uffl7m/" }, { "trust": 0.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15683" }, { "trust": 0.4, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.4, "url": "https://access.redhat.com/security/cve/cve-2020-15683" }, { "trust": 0.4, "url": "https://access.redhat.com/security/cve/cve-2020-15969" }, { "trust": 0.4, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.4, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.4, "url": "https://access.redhat.com/articles/11258" }, { "trust": 0.4, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.4, "url": "https://access.redhat.com/security/updates/classification/#important" }, { "trust": 0.3, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15968" }, { "trust": 0.3, "url": "https://security.gentoo.org/" }, { "trust": 0.3, "url": "https://creativecommons.org/licenses/by-sa/2.5" }, { "trust": 0.3, "url": "https://bugs.gentoo.org." }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15966" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15960" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15959" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15963" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15970" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15962" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15964" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15965" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15961" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15967" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15971" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27948" }, { "trust": 0.2, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27943" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27946" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29618" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29617" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29611" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29619" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27944" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15972" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15977" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15978" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15992" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15979" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15989" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15987" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15974" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15976" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6557" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15985" }, { "trust": 0.1, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4gwcwnhttyoh6hsfuxpgpbb6j6jyzhze/" }, { "trust": 0.1, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/sc3u3h6aisvzb5plzllnf4hmq4uffl7m/" }, { "trust": 0.1, "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24qfl4c3azkmfvl7lvsymu2dne5vvugs/" }, { "trust": 0.1, "url": "https://security-tracker.debian.org/tracker/chromium" }, { "trust": 0.1, "url": "https://www.debian.org/security/faq" }, { "trust": 0.1, "url": "https://www.debian.org/security/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8075" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:4947" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:4311" }, { "trust": 0.1, "url": "https://support.apple.com/ht212005." }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6472" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6506" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6467" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6534" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6545" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6571" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6514" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6482" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6532" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6475" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6540" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6470" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6511" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6559" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6471" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6576" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-16002" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6573" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6549" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6487" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6569" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6510" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6551" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6486" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-16001" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6483" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6490" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-16003" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6531" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6476" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6480" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6524" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6548" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6555" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6535" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6550" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6562" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6543" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6474" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6533" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6523" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6575" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6542" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6489" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6526" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6518" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6512" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6481" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6513" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6544" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6530" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6473" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6561" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6570" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6529" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6541" }, { "trust": 0.1, "url": "https://www.apple.com/itunes/" }, { "trust": 0.1, "url": "https://support.apple.com/ht212003." }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-27951" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-29613" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15986" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15983" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15991" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15973" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15975" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15981" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15988" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15984" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15980" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15982" }, { "trust": 0.1, "url": "https://security.gentoo.org/glsa/202010-01" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15990" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:4948" }, { "trust": 0.1, "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2020-47/" }, { "trust": 0.1, "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2020-46/" }, { "trust": 0.1, "url": "https://security.gentoo.org/glsa/202010-08" }, { "trust": 0.1, "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2020-45/" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:4310" } ], "sources": [ { "db": "VULHUB", "id": "VHN-169000" }, { "db": "PACKETSTORM", "id": "168970" }, { "db": "PACKETSTORM", "id": "159910" }, { "db": "PACKETSTORM", "id": "159679" }, { "db": "PACKETSTORM", "id": "160542" }, { "db": "PACKETSTORM", "id": "161131" }, { "db": "PACKETSTORM", "id": "160536" }, { "db": "PACKETSTORM", "id": "159587" }, { "db": "PACKETSTORM", "id": "159906" }, { "db": "PACKETSTORM", "id": "159746" }, { "db": "PACKETSTORM", "id": "159682" }, { "db": "NVD", "id": "CVE-2020-15969" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-169000" }, { "db": "PACKETSTORM", "id": "168970" }, { "db": "PACKETSTORM", "id": "159910" }, { "db": "PACKETSTORM", "id": "159679" }, { "db": "PACKETSTORM", "id": "160542" }, { "db": "PACKETSTORM", "id": "161131" }, { "db": "PACKETSTORM", "id": "160536" }, { "db": "PACKETSTORM", "id": "159587" }, { "db": "PACKETSTORM", "id": "159906" }, { "db": "PACKETSTORM", "id": "159746" }, { "db": "PACKETSTORM", "id": "159682" }, { "db": "NVD", "id": "CVE-2020-15969" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-11-03T00:00:00", "db": "VULHUB", "id": "VHN-169000" }, { "date": "2021-01-28T20:12:00", "db": "PACKETSTORM", "id": "168970" }, { "date": "2020-11-05T17:01:22", "db": "PACKETSTORM", "id": "159910" }, { "date": "2020-10-22T17:19:42", "db": "PACKETSTORM", "id": "159679" }, { "date": "2020-12-16T18:02:43", "db": "PACKETSTORM", "id": "160542" }, { "date": "2021-01-26T14:27:32", "db": "PACKETSTORM", "id": "161131" }, { "date": "2020-12-16T17:56:45", "db": "PACKETSTORM", "id": "160536" }, { "date": "2020-10-17T19:32:22", "db": "PACKETSTORM", "id": "159587" }, { "date": "2020-11-05T17:00:50", "db": "PACKETSTORM", "id": "159906" }, { "date": "2020-10-28T16:36:31", "db": "PACKETSTORM", "id": "159746" }, { "date": "2020-10-22T23:55:44", "db": "PACKETSTORM", "id": "159682" }, { "date": "2020-11-03T03:15:12.790000", "db": "NVD", "id": "CVE-2020-15969" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-07-21T00:00:00", "db": "VULHUB", "id": "VHN-169000" }, { "date": "2024-11-21T05:06:34.250000", "db": "NVD", "id": "CVE-2020-15969" } ] }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Debian Security Advisory 4824-1", "sources": [ { "db": "PACKETSTORM", "id": "168970" } ], "trust": 0.1 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "arbitrary", "sources": [ { "db": "PACKETSTORM", "id": "161131" }, { "db": "PACKETSTORM", "id": "159587" }, { "db": "PACKETSTORM", "id": "159746" } ], "trust": 0.3 } }
ghsa-4932-9h4w-23jv
Vulnerability from github
Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
{ "affected": [], "aliases": [ "CVE-2020-15969" ], "database_specific": { "cwe_ids": [ "CWE-416" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2020-11-03T03:15:00Z", "severity": "HIGH" }, "details": "Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "id": "GHSA-4932-9h4w-23jv", "modified": "2022-05-24T17:32:51Z", "published": "2022-05-24T17:32:51Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15969" }, { "type": "WEB", "url": "https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html" }, { "type": "WEB", "url": "https://crbug.com/1124659" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202101-30" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT212003" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT212005" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT212007" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT212009" }, { "type": "WEB", "url": "https://support.apple.com/kb/HT212011" }, { "type": "WEB", "url": "https://www.debian.org/security/2021/dsa-4824" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2020/Dec/24" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2020/Dec/26" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2020/Dec/27" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2020/Dec/29" }, { "type": "WEB", "url": "http://seclists.org/fulldisclosure/2020/Dec/30" } ], "schema_version": "1.4.0", "severity": [] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.