CVE-2020-15655

Mozilla: Extension APIs could be used to bypass Same-Origin Policy

A redirected HTTP request which is observed or modified through a web extension could bypass existing CORS checks, leading to potential disclosure of cross-origin information. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Canonical Mozilla Opensuse

Products

Ubuntu Linux Firefox Firefox Esr and 2 more

CVE-2020-15654

Mozilla: Custom cursor can overlay user interface

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-15653

Mozilla: Bypassing iframe sandbox when allowing popups

An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-15652

Mozilla: Potential leak of redirect targets when loading scripts in a worker

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. This vulnerability affects Firefox < 79, Firefox ESR < 68.11, Firefox ESR < 78.1, Thunderbird < 68.11, and Thunderbird < 78.1.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-15650

Mozilla: Overwriting local files through malicious file picker application

Given an installed malicious file picker application, an attacker was able to overwrite local files and thus overwrite Firefox settings (but not access the previous profile). *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Mozilla

Products

Android Firefox Esr

CVE-2020-15649

Mozilla: Exfiltrating local files through malicious file picker application

Given an installed malicious file picker application, an attacker was able to steal and upload local files of their choosing, regardless of the actually files picked. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.11.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Mozilla

Products

Android Firefox Esr

CVE-2020-12421

Mozilla: Add-On updates did not respect the same certificate trust rules as software updates

When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by an administrator.) This could have caused add-ons to become out-of-date silently without notification to the user. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-12420

Mozilla: Use-After-Free when trying to connect to a STUN server

When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 5 more

CVE-2020-12419

Mozilla: Use-after-free in nsGlobalWindowInner

When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 5 more

CVE-2020-12418

Mozilla: Information disclosure due to manipulated URL object

Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 5 more

CVE-2020-12417

Mozilla: Memory corruption due to missing sign-extension for ValueTags on ARM64

Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. *Note: this issue only affects Firefox on ARM64 platforms.* This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.

CVSS 3.1 · 8.8 High EPSS 2.7% KEV · Not listed

Vendors

Canonical Mozilla Opensuse and 1 more

Products

Ubuntu Linux Firefox Firefox Esr and 5 more

CVE-2020-12410

Mozilla: Memory safety bugs fixed in Firefox 77 and Firefox ESR 68.9

Mozilla developers reported memory safety bugs present in Firefox 76 and Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 3 more

CVE-2020-12406

Mozilla: JavaScript Type confusion with NativeTypes

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-12405

Mozilla: Use-after-free in SharedWorkerService

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-12399

nss: Timing attack on DSA signature generation

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Mozilla Redhat

Products

Debian Linux Firefox Firefox Esr and 2 more

CVE-2020-12395

Mozilla: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

CVSS 3.1 · 9.8 Critical EPSS 2.6% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-12393

Mozilla: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

CVSS 3.1 · 7.8 High EPSS 1.0% KEV · Not listed

Vendors

Microsoft Mozilla

Products

Windows Firefox Firefox Esr and 1 more

CVE-2020-12392

Mozilla: Arbitrary local file access with 'Copy as cURL'

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical Mozilla Redhat

Products

Ubuntu Linux Firefox Firefox Esr and 4 more

CVE-2020-12389

Mozilla: Sandbox escape with improperly separated process types

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

CVSS 3.1 · 10.0 Critical EPSS 1.7% KEV · Not listed

Vendors

Microsoft Mozilla

Products

Windows Firefox Firefox Esr

CVE-2020-12388

Mozilla: Sandbox escape with improperly guarded Access Tokens

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.

CVSS 3.1 · 10.0 Critical EPSS 3.5% KEV · Not listed

Vendors

Microsoft Mozilla

Products

Windows Firefox Firefox Esr