Log in Start free

Vulnerability · Published Mar 25, 2020 · Assigned by mozilla

CVE-2020-6812

Medium 5.3

In plain English

A medium-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.6%top 24.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20firefox74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.21firefox74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.22firefox74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.23firefox74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.20firefox-esr68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.21firefox-esr68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.22firefox-esr68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.23firefox-esr68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.21librewolf74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.22librewolf74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.23librewolf74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.24librewolf74.0-r0ALPINE-CVE-2020-6812
Alpine:v3.20thunderbird68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.21thunderbird68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.22thunderbird68.6.0-r0ALPINE-CVE-2020-6812
Alpine:v3.23thunderbird68.6.0-r0ALPINE-CVE-2020-6812
Debian:12firefox-esr68.6.0esr-1DEBIAN-CVE-2020-6812
Debian:13firefox-esr68.6.0esr-1DEBIAN-CVE-2020-6812
Debian:14firefox-esr68.6.0esr-1DEBIAN-CVE-2020-6812
Debian:12thunderbird1:68.6.0-1DEBIAN-CVE-2020-6812
Debian:13thunderbird1:68.6.0-1DEBIAN-CVE-2020-6812
Debian:14thunderbird1:68.6.0-1DEBIAN-CVE-2020-6812

Affected products (as reported)

VendorProductVersions
Mozilla Thunderbird unspecified – before 68.6
Mozilla Firefox unspecified – before 74unspecified – before ESR68.6
Mozilla Firefox ESR unspecified – before 68.6

References