PT-2020-5320 · Mozilla+4 · Firefox+4

Alex Mayorga · Published 2020-06-30 · Updated 2024-12-12 · CVE-2020-12416

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 78

Description A use-after-free issue in the VideoStreamEncoder may occur due to a race condition with VideoBroadcaster::AddOrUpdateSink, potentially leading to memory corruption and a crash. This issue may allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service.

Recommendations For versions prior to 78, update to version 78 or later to resolve the issue.

Exploit

Fix

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

ALT-PU-2020-2309

ALT-PU-2020-2408

ALT-PU-2020-2709

ALT-PU-2020-2933

ALT-PU-2020-2934

ALT-PU-2020-3442

ALT-PU-2021-1368

ALT-PU-2021-1369

ALT-PU-2021-3368

BDU:2021-00096

CVE-2020-12416

MGASA-2020-0378

OPENSUSE-SU-2020:0983-1

OPENSUSE-SU-2020:1017-1

OPENSUSE-SU-2020_0983-1

OPENSUSE-SU-2020_1017-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2020:14421-1

SUSE-SU-2020:1898-1

SUSE-SU-2020:1899-1

USN-4408-1

Affected Products

Alt Linux

Firefox

Linuxmint

Suse

Ubuntu

References · 1935

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1639734 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://osv.dev/vulnerability/openSUSE-SU-2020:1017-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12425 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-29/#CVE-2020-12416 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12422 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0378 · Vendor Advisory