10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.015 Low
EPSS
Percentile
87.1%
Severity: Critical
Date : 2020-05-06
CVE-ID : CVE-2020-6831 CVE-2020-12387 CVE-2020-12390 CVE-2020-12391
CVE-2020-12392 CVE-2020-12394 CVE-2020-12395 CVE-2020-12396
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1148
The package firefox before version 76.0-1 is vulnerable to multiple
issues including arbitrary code execution, content spoofing and
insufficient validation.
Upgrade to 76.0-1.
The problems have been fixed upstream in version 76.0.
None.
A buffer overflow could occur when parsing and validating SCTP chunks
in WebRTC, in Firefox before 76.0 and chromium before 81.0.4044.138.
This could have led to memory corruption and a potentially exploitable
crash.
A race condition has been found in Firefox before 76.0, when running
shutdown code for Web Worker, leading to a use-after-free
vulnerability. This results in a potentially exploitable crash.
An incorrect origin serialization of URLs with IPv6 addresses issue has
been found in Firefox before 76.0, and could lead to incorrect security
checks.
Documents formed using data: URLs in an object element failed to
inherit the CSP of the creating context in Firefox before 76.0. This
allowed the execution of scripts that should have been blocked, albeit
with a unique opaque origin.
The ‘Copy as cURL’ feature of Devtools’ network tab did not properly
escape the HTTP POST data of a request in Firefox before 76.0, which
can be controlled by the website. If a user used the ‘Copy as cURL’
feature and pasted the command into a terminal, it could have resulted
in the disclosure of local files.
A logic flaw has been found in the location bar implementation of
Firefox before 76.0, and could have allowed a local attacker to spoof
the current location by selecting a different origin and removing focus
from the input element.
Several memory safety bugs has been found in Firefox before 76.0 and
Firefox ESR before 68.8. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.
Several memory safety bugs have been found in Firefox before 76.0. Some
of these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.
A remote attacker might be able to spoof content, bypass security
checks and execute arbitrary code on the affected host.
https://bugzilla.mozilla.org/show_bug.cgi?id=1632241
https://crbug.com/1073602
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12387
https://bugzilla.mozilla.org/show_bug.cgi?id=1545345
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12390
https://bugzilla.mozilla.org/show_bug.cgi?id=1141959
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12391
https://bugzilla.mozilla.org/show_bug.cgi?id=1457100
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12392
https://bugzilla.mozilla.org/show_bug.cgi?id=1614468
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12394
https://bugzilla.mozilla.org/show_bug.cgi?id=1628288
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12395
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%2C1624098%2C1625749%2C1626382%2C1628076%2C1631508
https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12396
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488%2C1622291%2C1627644
https://security.archlinux.org/CVE-2020-6831
https://security.archlinux.org/CVE-2020-12387
https://security.archlinux.org/CVE-2020-12390
https://security.archlinux.org/CVE-2020-12391
https://security.archlinux.org/CVE-2020-12392
https://security.archlinux.org/CVE-2020-12394
https://security.archlinux.org/CVE-2020-12395
https://security.archlinux.org/CVE-2020-12396
bugzilla.mozilla.org/buglist.cgi?bug_id=1339601%2C1611938%2C1620488%2C1622291%2C1627644
bugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%2C1624098%2C1625749%2C1626382%2C1628076%2C1631508
bugzilla.mozilla.org/show_bug.cgi?id=1141959
bugzilla.mozilla.org/show_bug.cgi?id=1457100
bugzilla.mozilla.org/show_bug.cgi?id=1545345
bugzilla.mozilla.org/show_bug.cgi?id=1614468
bugzilla.mozilla.org/show_bug.cgi?id=1628288
bugzilla.mozilla.org/show_bug.cgi?id=1632241
crbug.com/1073602
security.archlinux.org/AVG-1148
security.archlinux.org/CVE-2020-12387
security.archlinux.org/CVE-2020-12390
security.archlinux.org/CVE-2020-12391
security.archlinux.org/CVE-2020-12392
security.archlinux.org/CVE-2020-12394
security.archlinux.org/CVE-2020-12395
security.archlinux.org/CVE-2020-12396
security.archlinux.org/CVE-2020-6831
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12387
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12390
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12391
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12392
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12394
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12395
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12396
www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-6831
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.015 Low
EPSS
Percentile
87.1%