SB2020121565 - Data handling in firefox (Alpine package)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020121565

SB2020121565 - Data handling in firefox (Alpine package)

Published: December 15, 2020

Security Bulletin ID SB2020121565
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Data handling (CVE-ID: CVE-2020-35112)

CWE-ID: CWE-19 - Data Handling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to the way Firefox processes downloaded files without extensions on Windows operating system. If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead.

The vulnerability affects Windows installations only.


Remediation

Install update from vendor's website.

References