CVE-2020-12425 — Out-of-bounds Read in Mozilla Firefox

CWE-125 — Out-of-bounds Read10 documents8 sources
Severity
6.5MEDIUMNVD
EPSS
0.5%
top 32.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla ThunderbirdDebian Firefox
Timeline
PublishedJul 9
Latest updateMay 24

Description

Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure. This vulnerability affects Firefox < 78.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages6 packages

▶debiandebian/firefox< firefox 78.0-1 (sid)
▶CVEListV5mozilla/firefoxunspecified — 78
▶NVDmozilla/firefox< 78.0
▶Ubuntumozilla/firefox< 78.0.1+build1-0ubuntu0.16.04.1+2
▶mozillamozilla/firefox

🔴Vulnerability Details

3
GHSA
GHSA-j6wx-wmhj-cffc: Due to confusion processing a hyphen character in Date↗2022-05-24
▶
OSV
firefox vulnerabilities↗2020-07-02
▶
OSV
CVE-2020-12425: Due to confusion processing a hyphen character in Date↗2020-07-01
▶

📋Vendor Advisories

5
Ubuntu
Firefox vulnerabilities↗2020-07-02
▶
Red Hat
Mozilla: Out of bound read in Date.parse()↗2020-06-30
▶
Debian
CVE-2020-12425: firefox - Due to confusion processing a hyphen character in Date.parse(), a one-byte out o...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-29: CVE-2020-12425↗
▶
Mozilla
Mozilla Foundation Security Advisory 2020-24: CVE-2020-12425↗
▶

💬Community

1
Bugzilla
CVE-2020-12425 Mozilla: Out of bound read in Date.parse()↗2020-08-26
▶