Information disclosure in firefox (Alpine package)

1) Information disclosure

EUVDB-ID: #VU48469

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-26965

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to the way software keyboards are handled by the Firefox. Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when using a software keyboard that remembers user input, a user typed their password and used that feature, the type of the password field was changed, resulting in a keyboard layout change and the possibility for the software keyboard to remember the typed password.

A local user leverage this behavior to gain access to passwords, stored by software keyboards.

Mitigation

Install update from vendor's website.

Vulnerable software versions

firefox (Alpine package): 77.0-r0 - 79.0-r1

External links

http://git.alpinelinux.org/aports/commit/?id=13a8f0d1284680f721e935cc6d3cb2649cf25093

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.