Published: 22/10/2020 Updated: 28/04/2022

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. (CVE-2020-15673) The Mozilla Foundation Security Advisory describes this flaw as:Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. (CVE-2020-15676) The Mozilla Foundation Security Advisory describes this flaw as:By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. (CVE-2020-15677) The Mozilla Foundation Security Advisory describes this flaw as:When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function `APZCTreeManager::ComputeClippedCompositionBounds` did not follow iterator invalidation rules. (CVE-2020-15678) Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4. (CVE-2020-15683) Use after free in WebRTC in Google Chrome before 86.0.4240.75 allowed a remote malicious user to potentially exploit heap corruption via a crafted HTML page. (CVE-2020-15969) In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. (CVE-2020-26950)

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr
mozilla thunderbird
mozilla firefox
debian debian linux 9.0
debian debian linux 10.0
opensuse leap 15.1
opensuse leap 15.2

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code For the stable distribution (buster), these problems have been fixed in version 7840esr-1~deb10u2 We recommend that you upgrade your firefox-esr packages For the detailed security status of firefox-esr ...

Multiple security issues have been found in Thunderbird, which may lead to the execution of arbitrary code or denial of service For the stable distribution (buster), these problems have been fixed in version 1:7840-1~deb10u1 We recommend that you upgrade your thunderbird packages For the detailed security status of thunderbird please refer to ...

The Mozilla Foundation Security Advisory describes this flaw as:Mozilla developer reported memory safety bugs present in Firefox 80 and Firefox ESR 782 Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15673) The Mozilla Foundatio ...

Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability ...

Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vul ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 82 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability ...

Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: firefox security update Type/Severity Security Advisory: Important Topic An update for firefox is now available for Red Hat Enterprise Linux 81 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring ...

Several memory safety bugs have been found in Firefox before 820 and Firefox ESR before 784 Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code ...

Mozilla Foundation Security Advisory 2020-45 Security Vulnerabilities fixed in Firefox 82 Announced October 20, 2020 Impact high Products Firefox Fixed in Firefox 82 ...

Mozilla Foundation Security Advisory 2020-46 Security Vulnerabilities fixed in Firefox ESR 784 Announced October 20, 2020 Impact high Products Firefox ESR Fixed in Firefox ESR 784 ...

Mozilla Foundation Security Advisory 2020-47 Security Vulnerabilities fixed in Thunderbird 784 Announced October 21, 2020 Impact high Products Thunderbird Fixed in Thunderbird 784 ...

CWE-787 CWE-416 https://www.mozilla.org/security/advisories/mfsa2020-45/https://www.mozilla.org/security/advisories/mfsa2020-46/https://www.mozilla.org/security/advisories/mfsa2020-47/https://bugzilla.mozilla.org/buglist.cgi?bug_id=1576843%2C1656987%2C1660954%2C1662760%2C1663439%2C1666140 https://www.debian.org/security/2020/dsa-4780 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00057.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00062.html https://lists.debian.org/debian-lts-announce/2020/10/msg00027.html https://security.gentoo.org/glsa/202010-08 http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00074.html https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4778 https://alas.aws.amazon.com/AL2/ALAS-2020-1572.html

Get Started

CVE-2020-15683

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect