Improper access control in Firefox ESR and Mozilla Firefox - CVE-2020-6797

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU25121

Improper access control in Firefox ESR and Mozilla Firefox - CVE-2020-6797

Published: February 11, 2020 / Updated: February 12, 2020


Vulnerability identifier: #VU25121
CSH Severity: Medium
CVSS v4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6797
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions imposed on extensions that are granted downloads.open permission. A remote attacker can bypass implemented security restrictions and launch or open arbitrary application on the system.

Note: the vulnerability affects Mac OSX users only.

Affected software

Firefox ESR
Mozilla Firefox
Gentoo Linux
Slackware Linux
Opensuse
Mozilla Thunderbird
firefox-esr (Alpine package)
thunderbird (Alpine package)

How to mitigate CVE-2020-6797

Install updates from vendor's website.

Firefox ESR - update to 68.5.0
Mozilla Firefox - update to 73.0
Mozilla Thunderbird - update to 68.5.0
firefox-esr (Alpine package) - update to 68.5.0-r0
thunderbird (Alpine package) - update to 68.5.0-r0

External References

Related Security Bulletins