Use After Free Affecting firefox package, versions <0:68.11.0-1.0.1.el7_8
Threat Intelligence
EPSS
0.58% (79th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE7-FIREFOX-2557864
- published 10 Apr 2022
- disclosed 21 May 2020
How to fix?
Upgrade Oracle:7 firefox to version 0:68.11.0-1.0.1.el7_8 or higher.
This issue was patched in ELSA-2020-3253.
NVD Description
Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by Oracle.
See How to fix? for Oracle:7 relevant fixed versions and status.
Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
References
- https://linux.oracle.com/cve/CVE-2020-6463.html
- https://linux.oracle.com/errata/ELSA-2020-3233.html
- https://linux.oracle.com/errata/ELSA-2020-3241.html
- https://linux.oracle.com/errata/ELSA-2020-3253.html
- https://linux.oracle.com/errata/ELSA-2020-3341.html
- https://linux.oracle.com/errata/ELSA-2020-3344.html
- https://linux.oracle.com/errata/ELSA-2020-3345.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.html
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_21.html
- https://crbug.com/1065186
- https://lists.debian.org/debian-lts-announce/2020/07/msg00027.html
- https://lists.debian.org/debian-lts-announce/2020/08/msg00006.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OQYH5OK7O4BU6E37WWG5SEEHV65BFSGR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLFZ5N4EK6I4ZJP5YSKLLVN3ELXEB4XT/
- https://security.gentoo.org/glsa/202007-60
- https://security.gentoo.org/glsa/202007-64
- https://usn.ubuntu.com/4443-1/
- https://www.debian.org/security/2020/dsa-4714
- https://www.debian.org/security/2020/dsa-4736
- https://www.debian.org/security/2020/dsa-4740
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQYH5OK7O4BU6E37WWG5SEEHV65BFSGR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLFZ5N4EK6I4ZJP5YSKLLVN3ELXEB4XT/
CVSS Scores
version 3.1