CVE-2020-6797: Input Validation
By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact. Note: this issue only occurs on Mac OSX. Other operating systems are unaffected. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.
Other sources
By downloading a file with the .fileloc extension, a semi-privileged extension could launch an arbitrary application on the user's computer. The attacker is restricted as they are unable to download non-quarantined files or supply command line arguments to the application, limiting the impact.Note: this issue only occurs on Mac OSX. Other operating systems are unaffected.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68.5 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 68.5 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 73 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 68.5 - Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 73 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 68.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-6797?
CVE-2020-6797 is a vulnerability that allows a semi-privileged extension to launch an arbitrary application on a user's computer.
How does CVE-2020-6797 work?
CVE-2020-6797 works by exploiting the download of a file with the .fileloc extension to execute a malicious application.
What is the impact of CVE-2020-6797?
The impact of CVE-2020-6797 is limited, as the attacker is unable to download non-quarantined files or supply command line arguments to the application.
Which software are affected by CVE-2020-6797?
Mozilla Firefox ESR versions up to 68.5 and Mozilla Firefox versions up to 73.0 are affected by CVE-2020-6797.
How can I mitigate CVE-2020-6797?
To mitigate CVE-2020-6797, it is recommended to update to Mozilla Firefox ESR version 68.5.0 or newer, or Mozilla Firefox version 73.0 or newer.