Every CVE Search/ Get API key

CVE-2020-35112

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the...

8.8 HighFix available

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.27%Down 9.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Record
CVE-2020-35112
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Record
CVE-2020-35112
Updated
2026-11-02
EUVDEUVD-2020-22808 No score

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Record
EUVD-2020-22808
Updated
2026-11-03
GitHub AdvisoriesGHSA-c2mj-qmxh-xhgx No score

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the...

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Record
GHSA-c2mj-qmxh-xhgx
Updated
2026-11-02
OSVALPINE-CVE-2020-35112 8.8

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Record
ALPINE-CVE-2020-35112
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2020-35112 8.8

If a user downloaded a file lacking an extension on Windows, and then "Open"-ed it from the downloads panel, if there was an executable file in the downloads directory with the same name but with an executable extension (such as .bat or .exe) that executable would have been launched instead. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

Record
UBUNTU-CVE-2020-35112
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVopenSUSE-SU-2020:2317-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 78.6
    • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
    • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
    • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
    • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
    • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
    • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
    • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
    • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
    • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
    • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
    • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
    • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
    • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
    • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
    • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
    • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
    • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
    • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
    • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
    • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
    • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
    • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2317-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2318-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.6.0 ESR
    • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2318-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2324-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 78.6
    • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
    • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
    • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
    • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
    • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
    • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
    • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
    • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
    • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
    • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
    • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
    • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
    • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
    • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
    • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
    • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
    • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
    • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
    • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
    • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
    • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
    • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2324-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2325-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.6.0 ESR
    • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2325-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2020:14584-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.6.0 ESR
    • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6
Record
SUSE-SU-2020:14584-1
Updated
2026-11-02
OSVSUSE-SU-2020:3900-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 78.6
    • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
    • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
    • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
    • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
    • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
    • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
    • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
    • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
    • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
    • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
    • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
    • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
    • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
    • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
    • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
    • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
    • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
    • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
    • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
    • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
    • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
    • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6
Record
SUSE-SU-2020:3900-1
Updated
2026-11-02
OSVSUSE-SU-2020:3901-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.6.0 ESR
    • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6
Record
SUSE-SU-2020:3901-1
Updated
2026-11-02
OSVSUSE-SU-2020:3902-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.6.0 ESR
    • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6
Record
SUSE-SU-2020:3902-1
Updated
2026-11-02
OSVSUSE-SU-2020:3903-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.6.0 ESR
    • Fixed: Various stability, functionality, and security fixes MFSA 2020-55 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6
Record
SUSE-SU-2020:3903-1
Updated
2026-11-02
OSVSUSE-SU-2020:3935-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird 78.6
    • new: MailExtensions: Added browser.windows.openDefaultBrowser() (bmo#1664708)
    • changed: Thunderbird now only shows quota exceeded indications on the main window (bmo#1671748)
    • changed: MailExtensions: menus API enabled in messages being composed (bmo#1670832)
    • changed: MailExtensions: Honor allowScriptsToClose argument in windows.create API function (bmo#1675940)
    • changed: MailExtensions: APIs that returned an accountId will reflect the account the message belongs to, not what is stored in message headers (bmo#1644032)
    • fixed: Keyboard shortcut for toggling message 'read' status not shown in menus (bmo#1619248)
    • fixed: OpenPGP: After importing a secret key, Key Manager displayed properties of the wrong key (bmo#1667054)
    • fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
    • fixed: OpenPGP: Discovering keys online via Key Manager sometimes failed on Linux (bmo#1634053)
    • fixed: OpenPGP: Encrypted attachment 'Decrypt and Open/Save As' did not work (bmo#1663169)
    • fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
    • fixed: OpenPGP: Verification of clear signed UTF-8 text failed (bmo#1679756)
    • fixed: Address book: Some columns incorrectly displayed no data (bmo#1631201)
    • fixed: Address book: The address book view did not update after changing the name format in the menu (bmo#1678555)
    • fixed: Calendar: Could not import an ICS file into a CalDAV calendar (bmo#1652984)
    • fixed: Calendar: Two 'Home' calendars were visible on a new profile (bmo#1656782)
    • fixed: Calendar: Dark theme was incomplete on Linux (bmo#1655543)
    • fixed: Dark theme did not apply to new mail notification popups (bmo#1681083)
    • fixed: Folder icon, message list, and contact side bar visual improvements (bmo#1679436)
    • fixed: MailExtensions: HTTP refresh in browser content tabs did not work (bmo#1667774)
    • fixed: MailExtensions: messageDisplayScripts failed to run in main window (bmo#1674932)
    • fixed: Various security fixes MFSA 2020-56 (bsc#1180039)
    • CVE-2020-16042 (bmo#1679003) Operations on a BigInt could have caused uninitialized memory to be exposed
    • CVE-2020-26971 (bmo#1663466) Heap buffer overflow in WebGL
    • CVE-2020-26973 (bmo#1680084) CSS Sanitizer performed incorrect sanitization
    • CVE-2020-26974 (bmo#1681022) Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
    • CVE-2020-26978 (bmo#1677047) Internal network hosts could have been probed by a malicious webpage
    • CVE-2020-35111 (bmo#1657916) The proxy.onRequest API did not catch view-source URLs
    • CVE-2020-35112 (bmo#1661365) Opening an extension-less download may have inadvertently launched an executable instead
    • CVE-2020-35113 (bmo#1664831, bmo#1673589) Memory safety bugs fixed in Thunderbird 78.6

Mozilla Thunderbird 78.5.1

  • new: OpenPGP: Added option to disable email subject encryption (bmo#1666073)
  • changed: OpenPGP public key import now supports multi-file selection and bulk accepting imported keys (bmo#1665145)
  • changed: MailExtensions: getComposeDetails will wait for 'compose-editor-ready' event (bmo#1675012)
  • fixed: New mail icon was not removed from the system tray at shutdown (bmo#1664586)
  • fixed: 'Place replies in the folder of the message being replied to' did not work when using 'Reply to List' (bmo#522450)
  • fixed: Thunderbird did not honor the 'Run search on server' option when searching messages (bmo#546925)
  • fixed: Highlight color for folders with unread messages wasn't visible in dark theme (bmo#1676697)
  • fixed: OpenPGP: Key were missing from Key Manager (bmo#1674521)
  • fixed: OpenPGP: Option to import keys from clipboard always disabled (bmo#1676842)
  • fixed: The 'Link' button on the large attachments info bar failed to open…
Record
SUSE-SU-2020:3935-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.12
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.13
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.14
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.15
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.16
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.17
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.18
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.19
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.20
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.21
 before 84.0.1-r0
84.0.1-r0
Show 61 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.22
 before 84.0.1-r0
84.0.1-r0
firefox
Alpine:v3.23
 before 84.0.1-r0
84.0.1-r0
firefox-esr
Alpine:v3.12
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.13
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.14
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.15
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.16
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.17
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.18
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.19
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.20
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.21
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.22
 before 78.6.0-r0
78.6.0-r0
firefox-esr
Alpine:v3.23
 before 78.6.0-r0
78.6.0-r0
librewolf
Alpine:v3.21
 before 84.0.1-r0
84.0.1-r0
librewolf
Alpine:v3.22
 before 84.0.1-r0
84.0.1-r0
librewolf
Alpine:v3.23
 before 84.0.1-r0
84.0.1-r0
librewolf
Alpine:v3.24
 before 84.0.1-r0
84.0.1-r0
thunderbird
Alpine:v3.16
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.17
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.18
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.19
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.20
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.21
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.22
 before 78.6.1-r0
78.6.1-r0
thunderbird
Alpine:v3.23
 before 78.6.1-r0
78.6.1-r0
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 78.6.0-78.108.1
78.6.0-78.108.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 8 CVEs
 before 78.6.0-3.113.1
78.6.0-3.113.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 8 CVEs
 before 78.6.0-8.20.2
78.6.0-8.20.2
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 8 CVEs
 before 78.6.0-3.122.1
78.6.0-3.122.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:OpenStack Cloud 9
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 8 CVEs
 before 78.6.0-112.39.1
78.6.0-112.39.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 9 CVEs
 before 78.6.0-8.3.1
78.6.0-8.3.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
mozjs78
Ubuntu:22.04:LTS
 All versions, plus listed versions
78.13.0-178.15.0-278.15.0-4ubuntu1
 None known
MozillaThunderbird
openSUSE:Leap 15.2
From an advisory covering 8 CVEs
 before 78.6.0-lp152.2.23.1
78.6.0-lp152.2.23.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 8 CVEs
 before 78.6.0-lp152.2.34.1
78.6.0-lp152.2.34.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 8 CVEs
 before 78.6.0-lp151.2.63.1
78.6.0-lp151.2.63.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 8 CVEs
 before 78.6.0-lp151.2.82.1
78.6.0-lp151.2.82.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35112 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published December 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in firefox 84.0.1-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,773 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open