Linux · Ubuntu · Package update · April 6, 2020

xul-ext-lightning 1:68.7.0+build1-0ubuntu0.18.04.1: xul-ext-lightning 1:68.7.0+build1-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)

xul-ext-lightning 1:68.7.0+build1-0ubuntu0.18.04.1, released April 6, 2020, fixes 18 CVEs in xul-ext-lightning. 2 of them are being exploited (CVE-2020-6820); 2 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now2 on CISA KEVUnsupported product
CVEs closed
18
2 rated Critical
Exploited
2
CVE-2020-6820
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0706
94th percentile

Priority of the 18 CVEs

Patch now 2 Urgent 0 High 9 Routine 7

Fixed package versions

ProductReleaseFixed in
xul-ext-lightningUbuntu 18.04.6 LTS (bionic)1:68.7.0+build1-0ubuntu0.18.04.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Patch now CVE-2020-6820 Mozilla Firefox And Thunderbird Use-After-Free Vulnerability8.8 0.0706 KEVExploited
Patch now CVE-2020-6819 Mozilla Firefox And Thunderbird Use-After-Free Vulnerability8.8 0.0304 KEVExploited
High CVE-2020-6811 Firefox ESR: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request,…8.8 0.0327 None reported
High CVE-2020-6806 Firefox ESR: By carefully crafting promise resolutions, it was possible to cause an out-of-bounds read off the end…8.8 0.0261 None reported
High CVE-2020-6800 Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox…8.8 0.0226 None reported
High CVE-2020-6825 Firefox ESR: Mozilla developers and community members Tyson Smith and Christian Holler reported memory safety bugs…9.8 0.0219 None reported
High CVE-2020-6814 Firefox ESR: Mozilla developers reported memory safety bugs present in Firefox and Thunderbird 68.5.9.8 0.0187 None reported
High CVE-2020-6821 Firefox ESR: When reading from areas partially or fully outside the source resource with WebGL's <code>copyTexSubImage</code>…7.5 0.0151 None reported
High CVE-2020-6805 Firefox ESR: When removing data about an origin whose tab was recently closed, a use-after-free could occur in the…8.8 0.0149 None reported
High CVE-2020-6807 Firefox ESR: When a device was changed while a stream was about to be destroyed, the <code>stream-reinit</code> task…8.8 0.0147 None reported
High CVE-2020-6822 Firefox ESR: On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB…8.8 0.0133 None reported
Routine CVE-2019-20503 xul-ext-lightning: usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_addresses_from_init.6.5 0.0314 None reported
Routine CVE-2020-6798 Firefox ESR: If a template tag was used in a select tag, the parser could be confused and allow JavaScript parsing…6.1 0.0205 None reported
Routine CVE-2020-6812 Firefox ESR: The first time AirPods are connected to an iPhone, they become named after the user's name by default…6.1 0.0160 None reported
Routine CVE-2020-6793 thunderbird: ELSA-2020-0577: thunderbird security update (IMPORTANT)6.5 0.0151 None reported
Routine CVE-2020-6792 thunderbird: ELSA-2020-0577: thunderbird security update (IMPORTANT)4.3 0.0133 None reported
Routine CVE-2020-6795 thunderbird: ELSA-2020-0577: thunderbird security update (IMPORTANT)6.5 0.0131 None reported
Routine CVE-2020-6794 thunderbird: ELSA-2020-0577: thunderbird security update (IMPORTANT)6.5 0.0102 None reported
Showing 1 to 18 of 18 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.