Mozilla Firefox: Access Confidential Data -- Remote/Unauthenticated

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.1590
     MFSA 2020-15 Security Vulnerabilities fixed in Firefox for iOS 25
                                5 May 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Mozilla Firefox
Publisher:         Mozilla
Operating System:  Apple iOS
Impact/Access:     Access Confidential Data -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-6830  

Original Bulletin: 
   https://www.mozilla.org/en-US/security/advisories/mfsa2020-15/

- --------------------------BEGIN INCLUDED TEXT--------------------

Mozilla Foundation Security Advisory 2020-15

Security Vulnerabilities fixed in Firefox for iOS 25

Announced
    May 1, 2020
Impact
    moderate
Products
    Firefox for iOS
Fixed in
       Firefox for iOS 25

# CVE-2020-6830: Native-to-JS bridging security token exploit

Reporter
    Vinoth Kumar
Impact
    moderate

Description

For native-to-JS bridging, the app requires a unique token to be passed that
ensures non-app code can't call the bridging functions. That token was being
used for JS-to-native also, but it isn't needed in this case, and its usage was
also leaking this token.

References

  o Bug 1632387

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXrD3RWaOgq3Tt24GAQhSaw/9E4tQiqgRPVP8B34xrJcnxp+J41o8KA5K
F4d8Odhi8JLQZ+pevs6fBFXMm8qZY4fFslEHslT8D3btFNRO0cdFiFn3kETEn2bt
DfLOBMZI/5X1cvXCsD97DQGl1HDlGV/20q1SeCWdaWmY2zxK+KWNM4LdLdBur5Sz
xyJ6N8bbmMT7NS5lFdBevwDbGuvkq8facDDB0L4fR8JuPrng/w/s2FG738jCrmSn
T8IzQ0ulQTpL3J87VZqUfc2LiYKcDpt8SSL/UAxzo8oPxHu90b7xTS4dTTi/+v6p
A05DOIAWMT/3ceM4PL0rsKZx25CLs9MFxk0o/EhQiRWylrReu86egtoAboOrSv9y
2oYAfPs3JgAirm36y1LGbAopDCzqIgCfoluFLoa7mOY/dfkEM8/lFuDO1xRBFInT
6X+IOKEDxOyD5HVRX+60bCsZw/BCErDYSLlnK0Jrk6oNPs8Es/5Au7LTOIHGLNYQ
QNXF3rCALSjOIErm4ZYoOYzSeQhfIc47itOiFAuJVo4fPjQb2MsnKi9V54lecK0d
zBeYrmgbmMcsmaQFc2TJ5Ou0XoYO6Xr6Rwe4CReSWCQGJIGjTpZXFSlcRVoijhQu
ODOwR4FWO/RnN2+k+8t5OL4JtKVWggIvusCJt3DKIpUlAMwx2Ij2GWsVtbJXWecW
ZHztRQGPSEo=
=oBWU
-----END PGP SIGNATURE-----