CVE-2020-12389

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. Note: this issue only affects Firefox on Windows operating systems.. This vulnerability affects Firefox ESR 68.8 and Firefox 76...

Command injection

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...

Media Foundation Privilege Escalation

The vulnerability of the Media Foundation component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to increase their privileges or gain access to modify, add, or delete data...

Media Foundation Disclosure

The vulnerability of the Media Foundation component in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow attackers to disclose sensitive information through a specially created file or website...

Win32k Privilege Escalation

The vulnerability of the Win32k component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges and gain full control over the system through a specially create...

GDI Component Code Execution

The vulnerability of the Graphics Device Interface GDI component in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted web page or...

Win32k Unauthorized Access

The vulnerability of the Win32k component in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow unauthorized access to protected information...

Security Vulnerabilities fixed in Firefox ESR 68.8 — Mozilla

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.Note: this issue only affects Firef...

Windows Memory Access Unauthorized Information

The vulnerability of Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Microsoft Patch Tuesday, April 2020 Edition

Microsoft today released updates to fix 113 security vulnerabilities in its various Windows operating systems and related software. Those include at least three flaws that are actively being exploited, as well as two others which were publicly detailed prior to today, potentially giving attackers...

Windows Installer Privilege Escalation

The vulnerability of the Windows Installer component in Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Windows Privilege Escalation

The vulnerability of the Windows operating system is related to the insecure management of privileges. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely, using a specially crafted .LNK file...

win32k Privilege Escalation

The vulnerability of the win32k component in Windows operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

Windows Hard Link Privilege Escalation

The vulnerability of Windows operating systems is related to errors in handling hard links. Exploiting this vulnerability can allow an attacker to increase their privileges...

Windows Installer Privilege Escalation

The vulnerability of the Windows Installer component in Windows operating systems is related to errors in the memory object handling mechanisms. Exploiting this vulnerability can allow an attacker to increase their privileges...

Graphics Device Interface Unauthorized Access

The vulnerability of the Graphics Device Interface GDI component in Windows operating systems is related to improper handling of objects in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created application...

SMBv3 Code Execution

The vulnerability of the Server Message Block SMBv3 network protocol implementation in Windows operating systems is related to incorrect handling of requests using data compression algorithms. Exploiting this vulnerability allows a remote attacker to execute arbitrary code with the help of a...

CVE-2020-6799

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that...

Windows Function Discovery Privilege Escalation

The vulnerability of the Windows Function Discovery service in Windows operating systems is related to errors in memory object handling. Exploiting this vulnerability can allow an attacker to increase their privileges through a specially created application...

Windows Media Services Privilege Escalation

The vulnerability of Windows Media Services on Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...