CVE-2020-15969: Use after free in WebRTC

Published Sep 3, 2020
ยท
Updated

A use-after-free bug in the usersctp library was reported upstream. We assume this could have led to memory corruption and a potentially exploitable crash.

Other sources

Use after free in WebRTC in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

WebRTC. A use after free issue was addressed with improved memory management.

Credit

an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, an anonymous researcher, Anonymous

Affected Software

64 affected componentsFixes available
debian/chromium
90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1
debian/firefox
121.0-2
debian/firefox-esr
91.12.0esr-1~deb10u1115.6.0esr-1~deb10u1102.15.0esr-1~deb11u1115.6.0esr-1~deb11u1115.5.0esr-1~deb12u1115.6.0esr-1~deb12u1115.6.0esr-1
debian/thunderbird
1:91.12.0-1~deb10u11:115.6.0-1~deb10u11:102.13.1-1~deb11u11:115.6.0-1~deb11u11:115.5.0-1~deb12u11:115.6.0-1~deb12u11:115.6.0-1
Apple tvOS<14.3
14.3
Apple macOS Big Sur<11.1
11.1
Apple Catalina
Apple Mojave
Apple WatchOS<7.2
7.2
Mozilla Thunderbird<78.4
78.4
Mozilla Firefox<82
82
Mozilla Firefox ESR<78.4
78.4
Google Chrome<86.0.4240.75
86.0.4240.75
Apple Safari<14.0.2
14.0.2
Apple iOS<14.3
14.3
Apple iPadOS<14.3
14.3
Google Chrome<86.0.4240.75
Debian Debian Linux=10.0
Fedoraproject Fedora=31
Fedoraproject Fedora=32
Fedoraproject Fedora=33
openSUSE Backports SLE=15.0-sp2
Apple Safari<14.0.2
Apple iPadOS<14.3
Apple iPhone OS<14.3
Apple macOS<11.1
Apple tvOS<14.3
Apple WatchOS<7.2
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox<82.0-r0
82.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/librewolf<82.0-r0
82.0-r0
alpine/librewolf<82.0-r0
82.0-r0
alpine/librewolf<82.0-r0
82.0-r0
alpine/librewolf<82.0-r0
82.0-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/chromium to a version that resolves this vulnerability.

    Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1
  2. Upgrade

    Upgrade debian/firefox to a version that resolves this vulnerability.

    Fixed in 121.0-2
  3. Upgrade

    Upgrade debian/firefox-esr to a version that resolves this vulnerability.

    Fixed in 91.12.0esr-1~deb10u1Fixed in 115.6.0esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.6.0esr-1~deb11u1Fixed in 115.5.0esr-1~deb12u1Fixed in 115.6.0esr-1~deb12u1Fixed in 115.6.0esr-1
  4. Upgrade

    Upgrade debian/thunderbird to a version that resolves this vulnerability.

    Fixed in 1:91.12.0-1~deb10u1Fixed in 1:115.6.0-1~deb10u1Fixed in 1:102.13.1-1~deb11u1Fixed in 1:115.6.0-1~deb11u1Fixed in 1:115.5.0-1~deb12u1Fixed in 1:115.6.0-1~deb12u1Fixed in 1:115.6.0-1
  5. Upgrade

    Upgrade tvOS to a version that resolves this vulnerability.

    Fixed in 14.3
  6. Upgrade

    Upgrade Apple macOS to a version that resolves this vulnerability.

    Fixed in 11.1
  7. Upgrade

    Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.

    Fixed in 7.2
  8. Upgrade

    Upgrade Thunderbird to a version that resolves this vulnerability.

    Fixed in 78.4
  9. Upgrade

    Upgrade Firefox to a version that resolves this vulnerability.

    Fixed in 82
  10. Upgrade

    Upgrade Firefox ESR to a version that resolves this vulnerability.

    Fixed in 78.4
  11. Upgrade

    Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.

    Fixed in 86.0.4240.75
  12. Upgrade

    Upgrade Safari to a version that resolves this vulnerability.

    Fixed in 14.0.2
  13. Upgrade

    Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.

    Fixed in 14.3
  14. Upgrade

    Upgrade Apple iOS, iPadOS, and macOS to a version that resolves this vulnerability.

    Fixed in 14.3
  15. Upgrade

    Upgrade alpine/firefox to a version that resolves this vulnerability.

    Fixed in 82.0-r0
  16. Upgrade

    Upgrade alpine/firefox-esr to a version that resolves this vulnerability.

    Fixed in 78.5.0-r0
  17. Upgrade

    Upgrade alpine/librewolf to a version that resolves this vulnerability.

    Fixed in 82.0-r0
  18. Upgrade

    Upgrade alpine/thunderbird to a version that resolves this vulnerability.

    Fixed in 78.5.1-r0

Event History

Sep 3, 2020
CVE Published
12:00 AM
Nov 3, 2020
CVE Published
via MITREยท02:21 AM
Data Sourced
via MITREยท02:21 AM
DescriptionWeakness
Data Sourced
via NVDยท03:15 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSVยท03:15 AM
DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2020-15969?

CVE-2020-15969 is a use-after-free issue in the WebRTC usersctp library.

2

What is the severity of CVE-2020-15969?

CVE-2020-15969 has a severity rating of high (7).

3

Which products are affected by CVE-2020-15969?

CVE-2020-15969 affects Apple macOS Big Sur (up to version 11.1), Apple Catalina, Apple Mojave, Mozilla Firefox (up to version 82), Apple iOS (up to version 14.3), Apple iPadOS (up to version 14.3), Apple Safari (up to version 14.0.2), Apple watchOS (up to version 7.2), Apple tvOS (up to version 14.3), Mozilla Thunderbird (up to version 78.4), and Mozilla Firefox ESR (up to version 78.4).

4

How can CVE-2020-15969 be fixed?

To fix CVE-2020-15969, users should update their affected software to the latest available version provided by the respective vendors.

5

Where can I find more information about CVE-2020-15969?

You can find more information about CVE-2020-15969 on the following references: [Mozilla Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1666570), [usrsctp Commit](https://github.com/sctplab/usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-45/).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
ยฉ 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203