KLA11670 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, perform cross-site scripting attack.

Below is a complete list of vulnerabilities:

1. A write-operation memory vulnerability can be exploited to cause denial of service.
2. Bypass security vulnerability can be exploited to execute arbitrary code only on Mac OSX.
3. Cross-site scripting vulnerability can be exploited remotely to perform cross-site scripting attacks.
4. A default handler vulnerability can be exploited to execute arbitrary code only in Windows.
5. A memory corruption vulnerability can be exploited to execute arbitrary code.

Original advisories

mfsa2020-06

Related products

Mozilla-Firefox-ESR

CVE list

CVE-2020-6800 high

CVE-2020-6797 warning

CVE-2020-6798 warning

CVE-2020-6799 high

CVE-2020-6796 high

Solution

Update to the latest version

Download Mozilla Firefox ESR

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Mozilla Firefox ESR earlier than 68.5