Description
When converting coordinates from projective to affine, the modular inversion was not performed in constant time, resulting in a possible timing-based side channel attack. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
References (4)
Core 4
Core References
Mailing List mailing-list
https://lists.debian.org/debian-lts-announce/2023/02/msg00021.html
Issue Tracking, Permissions Required, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1623116
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-36/
Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-39/
Scores
CVSS v3
4.7
EPSS
0.0015
EPSS Percentile
34.6%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-203
Status
published
Products (1)
mozilla/firefox
< 80.0 (2 CPE variants)
Published
Oct 08, 2020
Tracked Since
Feb 18, 2026