Permissions, Privileges, and Access Controls in Firefox ESR and Mozilla Firefox - CVE-2020-12388

Vulnerability details

The vulnerability allows a remote attacker to bypass sandbox restrictions.

The vulnerability exists due the Firefox content processes did not sufficiently lockdown access control due to improper protection of access tokens. A remote attacker can bypass implemented security restrictions and execute arbitrary code on the target system.

Note, this vulnerability affects Windows versions only.

Affected software

How to mitigate CVE-2020-12388

Links to Public Exploits and PoC-codes

• Exploit #2787 - Firefox Default Content Process DACL Sandbox Escape (May 29, 2020)

External References

• https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-17/
• https://bugzilla.mozilla.org/show_bug.cgi?id=1618911

Related Security Bulletins

• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Slackware Linux update for mozilla-firefox
• OpenSUSE Linux update for MozillaFirefox
• Permissions, Privileges, and Access Controls in mozjs68 (Alpine package)
• Permissions, Privileges, and Access Controls in firefox-esr (Alpine package)
• Permissions, Privileges, and Access Controls in firefox (Alpine package)