CVE-2020-12389
published 2020-05-26CVE-2020-12389: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on…
PriorityP350critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
1.73%
75.1th percentile
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| debian | firefox-esr | — | — |
| mozilla | firefox | < 76.0 | 76.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= unspecified < 76 | 76 |
| mozilla | firefox_esr | < 68.8.0 | 68.8.0 |
| mozilla | firefox_esr | >= unspecified < 68.8 | 68.8 |
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv10.0CRITICAL
vendor_debian10.0LOW
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Mozilla: Sandbox escape with improperly separated process types
vendor_redhat·2020-05-05·CVSS 10.0
CVE-2020-12389 [CRITICAL] CWE-284 Mozilla: Sandbox escape with improperly separated process types
Mozilla: Sandbox escape with improperly separated process types
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
The Mozilla Foundation Security Advisory describes this flaw as
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.
Statement: This issue only affects Firefox on Windows operating systems. Firefox on Linux is not affected.
Package: firefox (Red Hat Enterprise Linux 5) - Out of support scope
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Pa
Debian
CVE-2020-12389: firefox - The Firefox content processes did not sufficiently lockdown access control which...
vendor_debian·2020·CVSS 10.0
CVE-2020-12389 [CRITICAL] CVE-2020-12389: firefox - The Firefox content processes did not sufficiently lockdown access control which...
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2020-16: CVE-2020-12389
vendor_mozilla·CVSS 10.0
CVE-2020-12389 [CRITICAL] Mozilla Foundation Security Advisory 2020-16: CVE-2020-12389
Mozilla Foundation Security Advisory 2020-16
CVE: CVE-2020-12389
Product: Firefox
Impact: high
Fixed in: Firefox 76
Mozilla
Mozilla Foundation Security Advisory 2020-17: CVE-2020-12389
vendor_mozilla·CVSS 10.0
CVE-2020-12389 [CRITICAL] Mozilla Foundation Security Advisory 2020-17: CVE-2020-12389
Mozilla Foundation Security Advisory 2020-17
CVE: CVE-2020-12389
Product: Firefox ESR
Impact: critical
Fixed in: Firefox ESR 68.8
GHSA
GHSA-hgp4-9j3m-3phf: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
ghsa_unreviewed·2022-05-24
CVE-2020-12389 [HIGH] GHSA-hgp4-9j3m-3phf: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
OSV
CVE-2020-12389: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
osv·2020-05-26·CVSS 10.0
CVE-2020-12389 [CRITICAL] CVE-2020-12389: The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape
The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76.
No detection rules found.
No public exploits indexed.
https://bugzilla.mozilla.org/show_bug.cgi?id=1554110https://www.mozilla.org/security/advisories/mfsa2020-16/https://www.mozilla.org/security/advisories/mfsa2020-17/https://bugzilla.mozilla.org/show_bug.cgi?id=1554110https://www.mozilla.org/security/advisories/mfsa2020-16/https://www.mozilla.org/security/advisories/mfsa2020-17/
2020-05-26
Published