Mozilla Firefox/Firefox ESR/Thunderbird Download Special Char unusual condition

Summaryinfo

A vulnerability categorized as critical has been discovered in Mozilla Firefox, Firefox ESR and Thunderbird. Affected by this issue is some unknown functionality of the component Download. The manipulation as part of Special Char results in unusual condition. This vulnerability was named CVE-2020-15658. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Mozilla Firefox, Firefox ESR and Thunderbird (Web Browser) (affected version unknown). It has been classified as critical. Affected is an unknown functionality of the component Download. The manipulation as part of a Special Char leads to a unusual condition vulnerability. CWE is classifying the issue as CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. This is going to have an impact on integrity. CVE summarizes:

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

The weakness was presented 08/10/2020 as Bug 1637745 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.mozilla.org. This vulnerability is traded as CVE-2020-15658 since 07/10/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/11/2020).

Upgrading eliminates this vulnerability.

See VDB-159469, VDB-159467, VDB-159466 and VDB-159465 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox
• Firefox ESR
• Thunderbird

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion