Upstream information

CVE-2020-26955 at MITRE

Description

When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of whether the original and subsequent request were in private and non-private browsing modes. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 83.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.3
Vector AV:N/AC:M/Au:N/C:N/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None
CVSS v3 Scores
  National Vulnerability Database
Base Score 6.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact None
Integrity Impact High
Availability Impact None
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1178824 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • MozillaFirefox >= 92.0-1.2
  • MozillaFirefox-branding-upstream >= 92.0-1.2
  • MozillaFirefox-devel >= 92.0-1.2
  • MozillaFirefox-translations-common >= 92.0-1.2
  • MozillaFirefox-translations-other >= 92.0-1.2
  • firefox-esr >= 128.5.1-1.1
  • firefox-esr-branding-upstream >= 128.5.1-1.1
  • firefox-esr-translations-common >= 128.5.1-1.1
  • firefox-esr-translations-other >= 128.5.1-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-10600
openSUSE-Tumbleweed-2024-14572

SUSE Timeline for this CVE

CVE page created: Wed Dec 9 09:05:02 2020
CVE page last modified: Fri Dec 13 19:59:27 2024