CVE-2020-6799
Summary
| CVE | CVE-2020-6799 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-03-02 05:15:00 UTC |
|---|
| Updated | 2022-01-01 19:35:00 UTC |
|---|
| Description | Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected. This vulnerability affects Firefox < 73 and Firefox < ESR68.5. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Mozilla Firefox: Multiple vulnerabilities (GLSA 202003-02) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| Security Vulnerabilities fixed in Firefox 73 — Mozilla |
MISC |
www.mozilla.org |
Vendor Advisory |
| 1606596 - (CVE-2020-6799) File association Remote Code Execution via command line parameter injection in Firefox |
MISC |
bugzilla.mozilla.org |
Permissions Required |
| Security Vulnerabilities fixed in Firefox ESR68.5 — Mozilla |
MISC |
www.mozilla.org |
Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296076 Oracle Solaris 11.4 Support Repository Update (SRU) 19.3.0 Missing (CPUJAN2020)
- 500926 Alpine Linux Security Update for firefox-esr
