Bug 1884474 (CVE-2020-15667) - CVE-2020-15667 firefox: Invalid name length could result in a heap buffer overflow, leading to memory corruption
Summary: CVE-2020-15667 firefox: Invalid name length could result in a heap buffer ove...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-15667
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1884475
TreeView+ depends on / blocked
 
Reported: 2020-10-02 06:42 UTC by Michael Kaplan
Modified: 2021-02-26 09:42 UTC (History)
4 users (show)

Fixed In Version: firefox 80
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-10-05 03:58:14 UTC
Embargoed:

Attachments (Terms of Use)

Description Michael Kaplan 2020-10-02 06:42:28 UTC 
When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap buffer overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox < 80.


References: 

https://bugzilla.mozilla.org/show_bug.cgi?id=1653371
https://www.mozilla.org/security/advisories/mfsa2020-36/
Comment 1 Michael Kaplan 2020-10-02 06:42:31 UTC 
External References:

https://www.mozilla.org/security/advisories/mfsa2020-36/
Comment 2 Huzaifa S. Sidhpurwala 2020-10-05 03:58:18 UTC 
Statement:

Firefox and thunderbird packages shipped with Red Hat Enterprise Linux do not enable automatic updates. Therefore are not affected by this flaw.
Note You need to log in before you can comment on or make changes to this bug.