Data handling in Mozilla Firefox and Firefox ESR - CVE-2020-35112
Published: December 15, 2020
Vulnerability identifier: #VU49023
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-35112
CWE-ID: CWE-19
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mozilla Firefox
Firefox ESR
Mozilla Firefox
Firefox ESR
Software vendor:
Mozilla
Mozilla
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to the way Firefox processes downloaded files without extensions on Windows operating system. If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead.
The vulnerability affects Windows installations only.
Remediation
Install updates from vendor's website.