CVSS: 8.8EPSS: 1%CPEs: 6EXPL: 1CVE-2020-6811 – Mozilla: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
https://notcve.org/view.php?id=CVE-2020-6811
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. La funcionalidad "Copy as cURL" de la pestaña de red de Devtools no escapó correctamente el método HTTP de una petición, que puede ser controlada por el sitio web. Si un usuario utilizó la funcionalidad "Copy as Curl" y pegó el comando a un terminal, podría haber resultado en una inyección de comandos y una ejecución de comandos arbitraria. • https://bugzilla.mozilla.org/show_bug.cgi?id=1607742 https://usn.ubuntu.com/4328-1 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-08 https://www.mozilla.org/security/advisories/mfsa2020-09 https://www.mozilla.org/security/advisories/mfsa2020-10 https://access.redhat.com/security/cve/CVE-2020-6811 https://bugzilla.redhat.com/show_bug.cgi?id=1812202 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6812 – Mozilla: The names of AirPods with personally identifiable information were exposed to websites with camera or microphone permission
https://notcve.org/view.php?id=CVE-2020-6812
The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6. • https://bugzilla.mozilla.org/show_bug.cgi?id=1616661 https://usn.ubuntu.com/4328-1 https://usn.ubuntu.com/4335-1 https://www.mozilla.org/security/advisories/mfsa2020-08 https://www.mozilla.org/security/advisories/mfsa2020-09 https://www.mozilla.org/security/advisories/mfsa2020-10 https://access.redhat.com/security/cve/CVE-2020-6812 https://bugzilla.redhat.com/show_bug.cgi?id=1812204 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-6796 – Mozilla: Missing bounds check on shared memory read in the parent process
https://notcve.org/view.php?id=CVE-2020-6796
A content process could have modified shared memory relating to crash reporting information, crash itself, and cause an out-of-bound write. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 73 and Firefox < ESR68.5. Un procesamiento de contenido podría haber modificado una memoria compartida relacionada con la información de los reportes de bloqueos de aplicación, el bloqueo en sí mismo, y causar una escritura fuera de límites. Esto podría haber causado una corrupción de memoria y un bloqueo potencialmente explotable. • https://bugzilla.mozilla.org/show_bug.cgi?id=1610426 https://security.gentoo.org/glsa/202003-02 https://usn.ubuntu.com/4278-2 https://www.mozilla.org/security/advisories/mfsa2020-05 https://www.mozilla.org/security/advisories/mfsa2020-06 https://access.redhat.com/security/cve/CVE-2020-6796 https://bugzilla.redhat.com/show_bug.cgi?id=1801916 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2020-6799
https://notcve.org/view.php?id=CVE-2020-6799
Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected. • https://bugzilla.mozilla.org/show_bug.cgi?id=1606596 https://security.gentoo.org/glsa/202003-02 https://www.mozilla.org/security/advisories/mfsa2020-05 https://www.mozilla.org/security/advisories/mfsa2020-06 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-6797
https://notcve.org/view.php?id=CVE-2020-6797
By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact. Note: this issue only occurs on Mac OSX. Other operating systems are unaffected. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5. • https://bugzilla.mozilla.org/show_bug.cgi?id=1596668 https://security.gentoo.org/glsa/202003-02 https://www.mozilla.org/security/advisories/mfsa2020-05 https://www.mozilla.org/security/advisories/mfsa2020-06 https://www.mozilla.org/security/advisories/mfsa2020-07 • CWE-20: Improper Input Validation •