PT-2020-5605 · Mozilla+2 · Firefox+4
Samuel Attard
·
Published
2020-12-15
·
Updated
2024-12-12
·
CVE-2020-35112
CVSS v2.0
9.3
High
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 84
Thunderbird versions prior to 78.6
Firefox ESR versions prior to 78.6
Description
The issue is related to insufficient access control in Mozilla browsers, allowing a remote attacker to execute arbitrary code or cause a denial of service. On Windows, if a user downloads a file without an extension and opens it from the downloads panel, an executable file with the same name but with an executable extension (such as .bat or .exe) in the downloads directory would be launched instead. This issue only affects Windows operating systems.
Recommendations
For Firefox versions prior to 84, update to version 84 or later.
For Thunderbird versions prior to 78.6, update to version 78.6 or later.
For Firefox ESR versions prior to 78.6, update to version 78.6 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Firefox Esr
Suse
Thunderbird