PT-2020-14574 · Mozilla+6 · Firefox+8

Belden · Published 2020-07-28 · Updated 2024-12-12 · CVE-2020-15658

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 78.1 Firefox versions prior to 79 Thunderbird versions prior to 78.1

Description The issue arises from improper handling of special characters in the file download code, allowing an attacker to alter the file type being downloaded by cutting off the file ending at an earlier position. This discrepancy can lead to a different file type being downloaded than what is shown in the dialog.

Recommendations For Firefox ESR versions prior to 78.1, update to version 78.1 or later. For Firefox versions prior to 79, update to version 79 or later. For Thunderbird versions prior to 78.1, update to version 78.1 or later.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

ALT-PU-2020-2466

ALT-PU-2020-2598

ALT-PU-2020-2709

ALT-PU-2020-2933

ALT-PU-2020-2934

ALT-PU-2020-3442

ALT-PU-2021-1368

ALT-PU-2021-1369

ALT-PU-2021-2725

ALT-PU-2021-2881

ALT-PU-2021-3368

ALT-PU-2021-3369

ALT-PU-2022-1781

CESA-2020_3557

CVE-2020-15658

OPENSUSE-SU-2020:1147-1

OPENSUSE-SU-2020:1155-1

OPENSUSE-SU-2020:1189-1

OPENSUSE-SU-2020_1147-1

OPENSUSE-SU-2020_1155-1

OPENSUSE-SU-2020_1189-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2020:3555

RHSA-2020:3557

RHSA-2020:3559

RHSA-2020:4080

RHSA-2020_3557

RHSA-2020_4080

SUSE-SU-2020:14456-1

SUSE-SU-2020:2100-1

SUSE-SU-2020:2118-1

SUSE-SU-2020:2147-1

USN-4443-1

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Suse

Thunderbird

Ubuntu

References · 1910

• https://linux.oracle.com/errata/ELSA-2020-3557.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15656 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-32 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-30 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15658 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-30 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15655 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14456-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15653 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1147-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15658 · Security Note
• https://ubuntu.com/security/CVE-2020-15652 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1637745 · Vendor Advisory