SB2020072864 - Improperly implemented security check for standard in firefox (Alpine package)
Published: July 28, 2020
Security Bulletin ID
SB2020072864
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improperly implemented security check for standard (CVE-ID: CVE-2020-6514)
CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Green
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to WebRTC used the memory address of a class instance as a connection identifier. A remote attacker can use the obtained value to bypass ASLR protection.Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=4cd4a0dd2e6c9e8d082dca8588312badce9f16ba
- https://git.alpinelinux.org/aports/commit/?id=ecfc67fc0aa1c8be66b005da45f868c730633a4e
- https://git.alpinelinux.org/aports/commit/?id=04f8e005916c290085fcf9cff34c5ed43c7b570e
- https://git.alpinelinux.org/aports/commit/?id=4078c037d203ec86019f68e2ec6e03b7b6a7fcf4
- https://git.alpinelinux.org/aports/commit/?id=78431c6461742f7904f5cd815bbed5f76852a8aa
- https://git.alpinelinux.org/aports/commit/?id=d28edc9bebe787d7cff81e5dc7200f5b78fd3797