Vulnerability · Published Mar 2, 2020 · Assigned by mozilla

CVE-2020-6799

High 8.8

In plain English

A high-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.8High

Exploit odds (30 days)1.5%top 25.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected. This vulnerability affects Firefox < 73 and Firefox < ESR68.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	firefox-esr	68.5.0-r0	ALPINE-CVE-2020-6799
Alpine:v3.21	firefox-esr	68.5.0-r0	ALPINE-CVE-2020-6799
Alpine:v3.22	firefox-esr	68.5.0-r0	ALPINE-CVE-2020-6799
Alpine:v3.23	firefox-esr	68.5.0-r0	ALPINE-CVE-2020-6799

Affected products (as reported)

Vendor	Product	Versions
Mozilla	Firefox	unspecified – before 73unspecified – before ESR68.5

References

https://www.mozilla.org/security/advisories/mfsa2020-05/ x_refsource_MISC
https://www.mozilla.org/security/advisories/mfsa2020-06/ x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1606596 x_refsource_MISC
GLSA-202003-02 vendor-advisory, x_refsource_GENTOO