8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.924 High
EPSS
Percentile
99.0%
Severity: Critical
Date : 2020-11-10
CVE-ID : CVE-2020-26950
Package : firefox
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-1265
The package firefox before version 82.0.3-1 is vulnerable to arbitrary
code execution.
Upgrade to 82.0.3-1.
The problem has been fixed upstream in version 82.0.3.
None.
A use-after-free has been found in Firefox before 82.0.3 where, in
certain circumstances, the MCallGetProperty opcode can be emitted with
unmet assumptions.
A remote attacker can execute arbitrary code on the affected host.
https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/
https://www.mozilla.org/en-US/security/advisories/mfsa2020-49/#CVE-2020-26950
https://bugzilla.mozilla.org/show_bug.cgi?id=1675905
https://security.archlinux.org/CVE-2020-26950
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.924 High
EPSS
Percentile
99.0%