Home

CVE-2020-12406

Description

Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.355

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities fixed in Mozilla Firefox (77.0)Windows
Multiple vulnerabilities fixed in Mozilla Firefox (x64) (77.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird (68.9.0)Windows
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird (x64) (68.9.0)Windows
Multiple vulnerabilities are fixed in Mozilla Firefox For Mac (77.0.1)Mac
Vulnerabilities CVE-2020-12399,CVE-2020-12405,CVE-2020-12406,CVE-2020-12410,CVE-2020-12398 are fixed in Mozilla Thunderbird For Mac (68.9.0)Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 68.0.1Mac
Multiple Vulnerabilities are affected in Firefox ESR for Mac 68.0.1Mac
Vulnerabilities CVE-2020-12398,CVE-2020-12399,CVE-2020-12405,CVE-2020-12406 are affected in Mozilla Thunderbird for Mac 68.8.0Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 76.0.1Mac
(RHSA-2020:2378) firefox security update firefox-68.9.0-1.el6_10.i686.rpmLinux
(RHSA-2020:2378) firefox security update firefox-68.9.0-1.el6_10.x86_64.rpmLinux
(RHSA-2020:2381) firefox security update firefox-68.9.0-1.el7_8.i686.rpmLinux
(RHSA-2020:2381) firefox security update firefox-68.9.0-1.el7_8.x86_64.rpmLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb9u1_i386.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb9u1_amd64.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb10u1_i386.debLinux
firefox-esr security update(DSA-4695-1) firefox-esr_68.9.0esr-1~deb10u1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source web browser (USN-4383-1) firefox_77.0.1+build1-0ubuntu0.20.04.1_amd64.debLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-debuginfo-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-debugsource-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP4 ) MozillaFirefox-translations-common-68.9.0-109.123.1.x86_64.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-68.9.0-109.123.1.x86_64_SP5.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debuginfo-68.9.0-109.123.1.x86_64_SP5.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-debugsource-68.9.0-109.123.1.x86_64_SP5.rpmLinux
SUSE-SU-2020:1563-1(SUSE Linux Enterprise Server 12-SP5 ) MozillaFirefox-translations-common-68.9.0-109.123.1.x86_64_SP5.rpmLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb9u1_i386.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb9u1_amd64.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb10u1_i386.debLinux
thunderbird security update(DSA-4702-1) thunderbird_68.9.0-1~deb10u1_amd64.debLinux
(RHSA-2020:2613) thunderbird security update thunderbird-68.9.0-1.el6_10.i686.rpmLinux
(RHSA-2020:2613) thunderbird security update thunderbird-68.9.0-1.el6_10.x86_64.rpmLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.16.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.16.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.18.04.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.18.04.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.19.10.1_i386.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.19.10.1_amd64.debLinux
Mozilla Open Source mail and newsgroup client (USN-4421-1) thunderbird_68.10.0+build1-0ubuntu0.20.04.1_amd64.debLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-314495Mozilla Firefox (77.0)
PATCH-314496Mozilla Firefox (x64) (77.0)
PATCH-314521Mozilla Thunderbird (68.9.0)
PATCH-314522Mozilla Thunderbird (x64) (68.9.0)
PATCH-607000Mozilla Firefox For Mac (124.0)
PATCH-611353Mozilla Thunderbird For Mac (128.12.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611807Mozilla Thunderbird For Mac (142.0)
PATCH-611870Mozilla Firefox For Mac (142.0.1)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234