PT-2020-3496 · Mozilla+2 · Firefox+2

James Forshaw · Published 2020-05-05 · Updated 2024-12-12 · CVE-2020-12388

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 68.8 Firefox versions prior to 76

Description The issue is related to insufficient lockdown of access control in Firefox content processes, which could result in a sandbox escape. This problem only affects Firefox on Windows operating systems.

Recommendations For Firefox ESR versions prior to 68.8, update to version 68.8 or later. For Firefox versions prior to 76, update to version 76 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2020-1915

ALT-PU-2020-1932

ALT-PU-2020-1943

ALT-PU-2020-3442

ALT-PU-2021-3368

BDU:2020-03822

CVE-2020-12388

OPENSUSE-SU-2020:0621-1

OPENSUSE-SU-2020_0621-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2020:1209-1

SUSE-SU-2020:1218-1

SUSE-SU-2020:14359-1

Affected Products

Alt Linux

Firefox

Suse

References · 1905

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2020-12388 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-17 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0621-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-17/#CVE-2020-12388 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/650544 · Security Note
• https://mozilla.org/security/advisories/mfsa2020-16 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1618911 · Vendor Advisory