CVE-2020-6797: Input Validation

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1596668
• https://security.gentoo.org/glsa/202003-02
• https://www.mozilla.org/security/advisories/mfsa2020-05/
• https://www.mozilla.org/security/advisories/mfsa2020-06/
• https://www.mozilla.org/security/advisories/mfsa2020-07/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-06/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2020-07
• MFSA2020-06
• MFSA2020-05

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2020-6793
• CVE-2020-6794
• CVE-2020-6795
• CVE-2020-6797
• CVE-2020-6798
• CVE-2020-6792
• CVE-2020-6800
• CVE-2020-6796
• CVE-2020-6799
• CVE-2020-6801

Frequently Asked Questions

• What is CVE-2020-6797?

  CVE-2020-6797 is a vulnerability that allows a semi-privileged extension to launch an arbitrary application on a user's computer.

• How does CVE-2020-6797 work?

  CVE-2020-6797 works by exploiting the download of a file with the .fileloc extension to execute a malicious application.

• What is the impact of CVE-2020-6797?

  The impact of CVE-2020-6797 is limited, as the attacker is unable to download non-quarantined files or supply command line arguments to the application.

• Which software are affected by CVE-2020-6797?

  Mozilla Firefox ESR versions up to 68.5 and Mozilla Firefox versions up to 73.0 are affected by CVE-2020-6797.

• How can I mitigate CVE-2020-6797?

  To mitigate CVE-2020-6797, it is recommended to update to Mozilla Firefox ESR version 68.5.0 or newer, or Mozilla Firefox version 73.0 or newer.