Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2020-12424

MEDIUM6.5

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission;

Published Jul 1, 2020

Modified 7 months ago

Fix available

Details

When constructing a permission prompt for WebRTC, a URI was supplied from the content process. This URI was untrusted, and could have been the URI of an origin that was previously granted permission; bypassing the prompt. This vulnerability affects Firefox < 78.

Affected Packages

Ubuntu:16.04:LTSfirefox

Affected versions:

41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu145.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.2+75 more

Fixed in:

78.0.1+build1-0ubuntu0.16.04.1

Ubuntu:18.04:LTSfirefox

Affected versions:

56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu160.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.3+38 more

Fixed in:

78.0.1+build1-0ubuntu0.18.04.1

Ubuntu:20.04:LTSfirefox

Affected versions:

69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu271.0+build5-0ubuntu172.0.1+build1-0ubuntu172.0.2+build1-0ubuntu173.0+build1-0ubuntu173.0+build2-0ubuntu1+10 more

Fixed in:

78.0.1+build1-0ubuntu0.20.04.1

Ubuntu:Pro:18.04:LTSmozjs38

Affected versions:

38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4

Ubuntu:Pro:18.04:LTSmozjs52

Affected versions:

52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1

Ubuntu:Pro:20.04:LTSmozjs52

Affected versions:

52.9.1-1build152.9.1-1ubuntu3

Ubuntu:Pro:20.04:LTSmozjs68

Affected versions:

68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1

Ubuntu:18.04:LTSthunderbird

Affected versions:

1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.11:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.1+10 more

Fixed in:

1:78.8.1+build1-0ubuntu0.18.04.1

Ubuntu:20.04:LTSthunderbird

Affected versions:

1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.10.0+build1-0ubuntu0.20.04.11:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu11:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu1+4 more

Fixed in:

1:78.7.1+build1-0ubuntu0.20.04.1

References

REPORThttps://ubuntu.com/security/CVE-2020-12424 REPORThttps://ubuntu.com/security/notices/USN-4408-1 REPORThttps://www.cve.org/CVERecord?id=CVE-2020-12424 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12424 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2020-29/#CVE-2020-12424

CVSS Analysis

CVSS v3.1

6.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

HighI:H

Availability

NoneA:N

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVE-2020-12424 USN-4408-1

Ecosystems

Ubuntu 16.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS

Timeline

PublishedJul 1, 2020

ModifiedJun 3, 2025

UBUNTU-CVE-2020-12424 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2020-12424

Details

Affected Packages

References

CVSS Analysis

Related

Ecosystems

Timeline