Paper/Archive/CVE-2020-12395

CVE-2020-12395

Mozilla Firefox ESR — Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7.

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 85.3.853 × 2017.1 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

Affected

ProductAffectedFixed inSource

Firefox ESRunspecified – < 68.868.8CNA

Firefoxunspecified – < 7676CNA

Thunderbirdunspecified – < 68.8.068.8.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refmozilla.org/security/advisories/mfsa2020-18 refmozilla.org/security/advisories/mfsa2020-16 refmozilla.org/security/advisories/mfsa2020-17 refbugzilla.mozilla.org/buglist.cgi?bug_id=1595886%2C1611482%2C1614704%2C1624098%2C1625749%2C1626382%2C1628076%2C1631508 advisoryusn.ubuntu.com/4373-1 refsecurity.gentoo.org/glsa/202005-03 refsecurity.gentoo.org/glsa/202005-04