Data handling in Firefox ESR and Mozilla Firefox - CVE-2020-35112
Published: December 15, 2020
Vulnerability identifier: #VU49023
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-35112
CWE-ID: CWE-19
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to the way Firefox processes downloaded files without extensions on Windows operating system. If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead.
The vulnerability affects Windows installations only.
Affected software
Firefox ESR
Mozilla Firefox
Mozilla Thunderbird
firefox-esr (Alpine package)
thunderbird (Alpine package)
firefox (Alpine package)
Mozilla Firefox
Mozilla Thunderbird
firefox-esr (Alpine package)
thunderbird (Alpine package)
firefox (Alpine package)
How to mitigate CVE-2020-35112
Install updates from vendor's website.
Firefox ESR - update to 78.6.0
Mozilla Firefox - update to 84.0
Mozilla Thunderbird - update to 78.6.0
firefox-esr (Alpine package) - update to 78.6.0-r0
thunderbird (Alpine package) - update to 78.6.1-r0
firefox (Alpine package) - update to 84.0.1-r0
Mozilla Firefox - update to 84.0
Mozilla Thunderbird - update to 78.6.0
firefox-esr (Alpine package) - update to 78.6.0-r0
thunderbird (Alpine package) - update to 78.6.1-r0
firefox (Alpine package) - update to 84.0.1-r0