CVE-2020-6799
Description
Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected. This vulnerability affects Firefox < 73 and Firefox < ESR68.5.
How to fix
- mozilla firefox73.0 or later
- mozilla firefox_esr68.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox | v < 73.0 | 73.0 |
| mozilla firefox_esr | v < 68.5.0 | 68.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.