The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefox-esralpine-linux-upgrade-firefoxalpine-linux-upgrade-librewolfalpine-linux-upgrade-thunderbird | Aug 22, 2024 | Aug 10, 2020 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsource | Aug 27, 2020 | Aug 10, 2020 |
| Mfsa2020 30 | mozilla-firefox-upgrade-79_0 | Jul 29, 2020 | Jul 28, 2020 | |
| Mfsa2020 32 | mozilla-firefox-esr-upgrade-78_1 | Jul 29, 2020 | Jul 28, 2020 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-78_1 | Jul 29, 2020 | Jul 28, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-78-3-0-11-4-27-0-1-82-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-68-12-0-11-4-27-0-1-82-0oracle-solaris-11-4-upgrade-web-browser-firefox-78-3-0-11-4-27-0-1-82-0oracle-solaris-11-4-upgrade-web-data-firefox-bookmarks-78-3-0-11-4-27-0-1-82-0 | Jan 19, 2021 | Aug 10, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-firefox | Aug 29, 2020 | Jul 28, 2020 |
| Redhat_linux | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsource | Aug 27, 2020 | Aug 10, 2020 | |
| Suse | — | suse-upgrade-gstreamer-plugin-pipewiresuse-upgrade-libpipewire-0_3-0suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-slesuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-pipewiresuse-upgrade-pipewire-develsuse-upgrade-pipewire-docsuse-upgrade-pipewire-libjack-0_3suse-upgrade-pipewire-libpulse-0_3suse-upgrade-pipewire-modulessuse-upgrade-pipewire-spa-plugins-0_2suse-upgrade-pipewire-spa-toolssuse-upgrade-pipewire-tools | Aug 1, 2020 | Jul 31, 2020 |
| Ubuntu | ubuntu-upgrade-firefox | Aug 5, 2020 | Jul 29, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub