Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 6 |
| CVE-ID | CVE-2020-6800 CVE-2020-6799 CVE-2020-6797 CVE-2020-6798 CVE-2020-6796 CVE-2020-6801 |
| CWE-ID | CWE-119 CWE-78 CWE-284 CWE-94 CWE-787 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Mozilla Firefox Client/Desktop applications / Web browsers Firefox ESR Client/Desktop applications / Web browsers |
| Vendor | Mozilla |
Security Bulletin
This security bulletin contains information about 6 vulnerabilities.
1) Memory corruption
EUVDB-ID: #VU25124
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-6800
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 72.0.2
Firefox ESR: 60.0 - 68.4.2
CPE2.3 External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
http://www.mozilla.org/en-US/security/advisories/mfsa2020-06/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
2) OS Command Injection
EUVDB-ID: #VU25123
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-6799
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation when opening PDF links from other applications and Firefox is configured as a default PDF reader. A remote unauthenticated attacker can trick the victim into clicking on a specially crafted link and execute arbitrary OS commands on the system.
Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 72.0.2
Firefox ESR: 60.0 - 68.4.2
CPE2.3 External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
http://www.mozilla.org/en-US/security/advisories/mfsa2020-06/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
3) Improper access control
EUVDB-ID: #VU25121
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-6797
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions imposed on extensions that are granted downloads.open permission. A remote attacker can bypass implemented security restrictions and launch or open arbitrary application on the system.
Note: the vulnerability affects Mac OSX users only. MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 72.0.2
Firefox ESR: 60.0 - 68.4.2
CPE2.3 External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
http://www.mozilla.org/en-US/security/advisories/mfsa2020-06/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
4) Code Injection
EUVDB-ID: #VU25122
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-6798
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary JavaScript code on the target system.
The vulnerability exists due to improper input validation when parsing template tag. A remote attacker can confuse the JavaScript parser into executing an arbitrary JavaScript send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 72.0.2
Firefox ESR: 60.0 - 68.4.2
CPE2.3 External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
http://www.mozilla.org/en-US/security/advisories/mfsa2020-06/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
5) Out-of-bounds write
EUVDB-ID: #VU25120
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-6796
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when reading shared memory in the parent process. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 72.0.2
Firefox ESR: 60.0 - 68.4.2
CPE2.3 External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
http://www.mozilla.org/en-US/security/advisories/mfsa2020-06/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
6) Buffer overflow
EUVDB-ID: #VU25125
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-6801
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 72.0.2
CPE2.3 External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?
