CVE-2020-12411

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox 76. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 77.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Jul 9, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-124124.3By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect domain (with the https:// schemeCVE-2020-124135.9The Raccoon attack is a timing attack on DHE ciphersuites inherit in the TLS specification. To mitigate this vulnerability, Firefox disabledCVE-2020-124146.5IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly CVE-2020-124156.5When "%2F" was present in a manifest URL, Firefox's AppCache behavior may have become confused and allowed a manifest to be served from a suCVE-2020-124168.8A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory cCVE-2020-124178.8Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a poCVE-2020-124186.5Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This CVE-2020-124198.8When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-freCVE-2020-12425.3An information disclosure vulnerability exists in the way that Microsoft Edge handles cross-origin requests, aka 'Microsoft Edge InformationCVE-2020-124208.8When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and CVE-2020-124216.5When performing add-on updates, certificate chains terminating in non-built-in-roots were rejected (even if they were legitimately added by CVE-2020-124228.8In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable to overflow, resulting in an out o