Home

CVE-2020-12405

Description

When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Risk Information

Base Score
5.3
MODERATE
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.664

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2020-12399,CVE-2020-12405 are fixed in Mozilla Firefox ESR (68.9.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405 are fixed in Mozilla Firefox ESR (x64) (68.9.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (77.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (x64) (77.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird (68.9.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird (x64) (68.9.0)Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (77.0.1)Mac
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird For Mac (68.9.0)Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 68.0.1Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 68.0.1Mac
Vulnerabilities CVE-2020-12398,CVE-2020-12399,CVE-2020-12405,CVE-2020-12406 are affected in Mozilla Thunderbird for Mac 68.8.0Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 76.0.1Mac
Vulnerabilities CVE-2020-12399,CVE-2020-12405 are fixed in Mozilla Firefox For Mac 68.9Mac
(RHSA-2020:2378) firefox security update firefox-68.9.0-1.el6_10.i686.rpmLinux
(RHSA-2020:2378) firefox security update firefox-68.9.0-1.el6_10.x86_64.rpmLinux
(RHSA-2020:2381) firefox security update firefox-68.9.0-1.el7_8.i686.rpmLinux
(RHSA-2020:2381) firefox security update firefox-68.9.0-1.el7_8.x86_64.rpmLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb9u1_i386.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb9u1_amd64.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb10u1_i386.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb10u1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.20.04.1_amd64.debLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-debuginfo-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-debugsource-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-translations-common-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-68.9.0-109.123.1.x86_64_SP5.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debuginfo-68.9.0-109.123.1.x86_64_SP5.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debugsource-68.9.0-109.123.1.x86_64_SP5.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-translations-common-68.9.0-109.123.1.x86_64_SP5.rpmLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb9u1_i386.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb9u1_amd64.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb10u1_i386.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb10u1_amd64.debLinux
(RHSA-2020:2613) thunderbird security update thunderbird-68.9.0-1.el6_10.i686.rpmLinux
(RHSA-2020:2613) thunderbird security update thunderbird-68.9.0-1.el6_10.x86_64.rpmLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.20.04.1_amd64.debLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-314497Mozilla Firefox ESR (68.9.0)
PATCH-314498Mozilla Firefox ESR (x64) (68.9.0)
PATCH-314495Mozilla Firefox (77.0)
PATCH-314496Mozilla Firefox (x64) (77.0)
PATCH-314521Mozilla Thunderbird (68.9.0)
PATCH-314522Mozilla Thunderbird (x64) (68.9.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-612783Mozilla Firefox For Mac (145.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234