SB2020112925 - Resource management error in firefox (Alpine package)
Published: November 29, 2020
Security Bulletin ID
SB2020112925
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource management error (CVE-ID: CVE-2020-26967)
The vulnerability allows a remote attacker to introduce an unexpected behavior.
The vulnerability exists due to improper management of internal resources within Mutation Observers. When listening for page changes with a Mutation Observer, a malicious web page could confuse Firefox Screenshots into interacting with elements other than those that it injected into the page. This would lead to internal errors and unexpected behavior in the Screenshots code.
Remediation
Install update from vendor's website.