SB2020050511 - Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020050511

SB2020050511 - Multiple vulnerabilities in Mozilla Firefox and Firefox ESR

Published: May 5, 2020 Updated: July 1, 2021

Security Bulletin ID SB2020050511
Severity
High
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 55% Medium 27% Low 18%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2020-12387)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error caused by the race condition when running shutdown code for Web Worker. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-12388)

The vulnerability allows a remote attacker to bypass sandbox restrictions.

The vulnerability exists due the Firefox content processes did not sufficiently lockdown access control due to improper protection of access tokens. A remote attacker can bypass implemented security restrictions and execute arbitrary code on the target system.

Note, this vulnerability affects Windows versions only.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-12389)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due the Firefox content processes did not sufficiently lockdown access control for separate process types. A remote attacker can bypass implemented security restrictions and execute arbitrary code on the target system.

Note, this vulnerability affects Windows versions only.

4) Buffer overflow (CVE-ID: CVE-2020-6831)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing SCTP chunks in WebRTC. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Input validation error (CVE-ID: CVE-2020-12390)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to incorrect origin serialization of nsIPrincipal.origin for IPv6 addresses. A remote attacker can bypass implemented security restrictions with a specially crafted URL.


6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-12391)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to documents formed using data: URLs in an object element failed to inherit the CSP of the creating context. A remote attacker can execute arbitrary scripts that should have been blocked, albeit with a unique opaque origin.


7) Input validation error (CVE-ID: CVE-2020-12392)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to the "Copy as cURL" feature of Devtools network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files.


8) Input validation error (CVE-ID: CVE-2020-12393)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to the "Copy as cURL" feature of Devtools network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution.

Note, this vulnerability affects Windows installations only.


9) Spoofing attack (CVE-ID: CVE-2020-12394)

The vulnerability allows a local user to perform spoofing attack.

The vulnerability exists due to a logic flaw in the location bar implementation. A local user can spoof  the current location by selecting a different origin and removing focus from the input element.


10) Buffer overflow (CVE-ID: CVE-2020-12395)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


11) Buffer overflow (CVE-ID: CVE-2020-12396)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References