Improper Input Validation The advisory has been revoked - it doesn't affect any version of package firefox Open this link in a new tab

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:16.04.

Note: Versions mentioned in the description apply only to the upstream firefox package and not the firefox package as distributed by Ubuntu.

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that insufficiently sanitized URL data. In that situation, clicking a link in the third party application could have been used to retrieve and execute files whose location was supplied through command line arguments. Note: This issue only affects Windows operating systems and when Firefox is configured as the default handler for non-default filetypes. Other operating systems are unaffected. This vulnerability affects Firefox < 73 and Firefox < ESR68.5.

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-6799
• https://security.gentoo.org/glsa/202003-02
• https://bugzilla.mozilla.org/show_bug.cgi?id=1606596
• https://www.mozilla.org/security/advisories/mfsa2020-05/
• https://www.mozilla.org/security/advisories/mfsa2020-06/