Vulnerability Spotlight: Remote code execution vulnerability in Firefox’s SharedWorkerService function
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-12405 | When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. NVD description · AI analysis pending | 5.3 | 1% | PoC |
| — |
Full article244 words · extracted from blog.talosintelligence.com · click to collapse
Wednesday, June 10, 2020 10:00
Marcin “Icewall” Noga of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw.
The Mozilla Firefox web browser contains a vulnerability in its SharedWorkerService function that could allow an attacker to gain the ability to remotely execute code on a target’s machine. This
vulnerability can be triggered if the user visits a malicious web page. The attacker can design this page in a way that it would cause a race condition, eventually leading to a use-after-free vulnerability and remote code execution.
In accordance with our coordinated disclosure policy, Cisco Talos worked with Mozilla to ensure that these issues are resolved and that an update is available for affected customers.
Vulnerability details Mozilla Firefox SharedWorkerService code execution vulnerability (TALOS-2020-1053/CVE-2020-12405)
An exploitable code execution vulnerability exists in the SharedWorkerService functionality of Mozilla Firefox, version 76.0a1 (2020-04-01) x64. A specially crafted HTML web page can cause a use-after-free condition, resulting in remote code execution. The victim needs to visit a malicious web site to trigger the vulnerability.
Read the complete vulnerability advisory here for additional information.
Versions tested Talos tested and confirmed that this vulnerability affects Mozilla Firefox, version 76.0a1 (2020-04-01), x64.
Coverage The following SNORTⓇ rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.
Snort Rules: 53759, 53760
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vuln-spotlight-firefox-shared-service-june-2020/