Log in Start free

Vulnerability · Published Mar 2, 2020 · Assigned by mozilla

CVE-2020-6797

Medium 4.3

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)1.5%top 26.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact. Note: this issue only occurs on Mac OSX. Other operating systems are unaffected. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox-esr68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.21firefox-esr68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.22firefox-esr68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.23firefox-esr68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.20thunderbird68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.21thunderbird68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.22thunderbird68.5.0-r0ALPINE-CVE-2020-6797
Alpine:v3.23thunderbird68.5.0-r0ALPINE-CVE-2020-6797

Affected products (as reported)

VendorProductVersions
Mozilla Thunderbird unspecified – before 68.5
Mozilla Firefox unspecified – before 73unspecified – before ESR68.5

References