CVE-2020-12399 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.4 MEDIUM	LOCAL	HIGH	LOW	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
mozilla	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 28%

Vendor	Product	Version
mozilla	firefox	𝑥 < 77.0
mozilla	firefox_esr	𝑥 < 68.9.0
mozilla	thunderbird	𝑥 < 68.9.0
debian	debian_linux	9.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

firefox

sid	132.0.1-1 fixed

firefox-esr

bullseye	115.14.0esr-1~deb11u1 fixed
bullseye (security)	128.4.0esr-1~deb11u1 fixed
bookworm	115.14.0esr-1~deb12u1 fixed
bookworm (security)	128.4.0esr-1~deb12u1 fixed
trixie	128.3.1esr-2 fixed
sid	128.4.0esr-1 fixed

nss

bullseye	2:3.61-1+deb11u3 fixed
bullseye (security)	2:3.61-1+deb11u4 fixed
bookworm	2:3.87.1-1 fixed
sid	2:3.105-2 fixed
trixie	2:3.105-2 fixed

thunderbird

bullseye	1:115.12.0-1~deb11u1 fixed
bullseye (security)	1:128.4.0esr-1~deb11u1 fixed
bookworm	1:115.12.0-1~deb12u1 fixed
bookworm (security)	1:128.4.0esr-1~deb12u1 fixed
sid	1:128.4.0esr-1 fixed
trixie	1:128.4.0esr-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

firefox

focal	Fixed 77.0.1+build1-0ubuntu0.20.04.1 released
eoan	Fixed 77.0.1+build1-0ubuntu0.19.10.1 released
bionic	Fixed 77.0.1+build1-0ubuntu0.18.04.1 released
xenial	Fixed 77.0.1+build1-0ubuntu0.16.04.1 released
trusty	dne

nss

focal	Fixed 2:3.49.1-1ubuntu1.1 released
eoan	Fixed 2:3.45-1ubuntu2.3 released
bionic	Fixed 2:3.35-2ubuntu2.8 released
xenial	Fixed 2:3.28.4-0ubuntu0.16.04.11 released
trusty	Fixed 2:3.28.4-0ubuntu0.14.04.5+esm5 released

thunderbird

focal	Fixed 1:68.10.0+build1-0ubuntu0.20.04.1 released
eoan	Fixed 1:68.10.0+build1-0ubuntu0.19.10.1 released
bionic	Fixed 1:68.10.0+build1-0ubuntu0.18.04.1 released
xenial	Fixed 1:68.10.0+build1-0ubuntu0.16.04.1 released
trusty	dne

Common Weakness Enumeration

CWE-203 - Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1631576

https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html

https://security.gentoo.org/glsa/202007-49

https://usn.ubuntu.com/4421-1/

https://www.debian.org/security/2020/dsa-4726

https://www.mozilla.org/security/advisories/mfsa2020-20/

https://www.mozilla.org/security/advisories/mfsa2020-21/

https://www.mozilla.org/security/advisories/mfsa2020-22/

https://bugzilla.mozilla.org/show_bug.cgi?id=1631576

https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html

https://security.gentoo.org/glsa/202007-49

https://usn.ubuntu.com/4421-1/

https://www.debian.org/security/2020/dsa-4726

https://www.mozilla.org/security/advisories/mfsa2020-20/

https://www.mozilla.org/security/advisories/mfsa2020-21/

https://www.mozilla.org/security/advisories/mfsa2020-22/