Shulou(Shulou.com)06/01 Report--

Today, I will talk to you about the example analysis of CFirefox exploitation vulnerabilities, which may not be well understood by many people. in order to make you understand better, the editor has summarized the following for you. I hope you can get something according to this article.

0x00 vulnerability background

On April 4, 2020, 360CERT Monitoring found that Mozilla officially issued a security notice on April 03, 2020, which contains two serious vulnerabilities in Firefox, the CVE numbers are CVE-2020-6819 and CVE-2020-6820 respectively.

Both vulnerabilities are under certain conditions, when processing nsDocShell destructors or ReadableStream, race conditions may cause use-after-free (release reuse) to cause malicious attackers to put code into Firefox memory and execute it in the context of the browser. At present, Mozilla officials have captured the attempt of exploitation in the opposition.

0x01 risk rating

360CERT evaluates the security update

Evaluation methods, threat levels, high risk effects are extensive.

360CERT recommends that users update Firefox and Firefox ESR in a timely manner. Do a good job of asset self-check / self-test / prevention to avoid attack.

0x02 affects version

Firefox < 74.0.1

Firefox ESR < 68.6.1

0x03 repair recommendation

Update Firefox to version 74.0.1

Update Firefox ESR to version 68.6.1

After reading the above, do you have any further understanding of the example analysis of CFirefox exploits? If you want to know more knowledge or related content, please follow the industry information channel, thank you for your support.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.