CVE-2020-12414: Medium severity Mozilla Firefox Iphone Os vulnerability

Q: What is the severity of CVE-2020-12414?

CVE-2020-12414 has been rated as a moderate severity vulnerability.

Q: How do I fix CVE-2020-12414?

To fix CVE-2020-12414, update your Firefox browser to a version higher than 27.0.

Q: What impact does CVE-2020-12414 have?

CVE-2020-12414 can lead to sensitive data persisting in IndexedDB after private browsing sessions.

Q: Who is affected by CVE-2020-12414?

CVE-2020-12414 affects Mozilla Firefox version 27 and earlier on iOS devices.

Q: What type of vulnerability is CVE-2020-12414?

CVE-2020-12414 is classified as a data leakage vulnerability related to improper handling of IndexedDB.

Published Jun 25, 2020

Updated

IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode.

Affected Software

4 affected components

Mozilla Firefox Iphone Os<27.0

All of the following

Mozilla Firefox=27

Apple iOS

Mozilla Firefox Mobile Iphone Os<27.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox for iOS to a version that resolves this vulnerability.
Fixed in 27
Operational
Ensure IndexedDB is cleared when leaving private browsing mode (delete the private instance of WKWebViewConfiguration when exiting private mode).

Event History

Jun 25, 2020

CVE Published

12:00 AM

Jul 9, 2020

CVE Published

via MITRE·02:56 PM

Data Sourced

via MITRE·02:56 PM

DescriptionWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

MFSA2020-23

Peer vulnerabilities

Found alongside the following vulnerabilities.

CVE-2020-12414

Frequently Asked Questions

What is the severity of CVE-2020-12414?