PT-2020-14575 · Mozilla+3 · Firefox For Android+4

Gunes Acar · Published 2020-08-25 · Updated 2024-12-12 · CVE-2020-15666

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 80 Firefox for Android versions prior to 80

Description The issue allows for information leakage via the MediaError message when attempting to load non-video content in an audio/video context, disclosing the exact status code. This inconsistency with standardized onerror/onsuccess disclosure can lead to attacks such as inferring login status to services or device discovery on a local network.

Recommendations For Firefox versions prior to 80, update to version 80 or later to resolve the issue. For Firefox for Android versions prior to 80, update to version 80 or later to resolve the issue.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

ALT-PU-2020-2706

ALT-PU-2020-3442

ALT-PU-2021-3368

CVE-2020-15666

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-4474-1

USN-4474-2

Affected Products

Alt Linux

Firefox

Firefox For Android

Linuxmint

Ubuntu

References · 1893

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1450853 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://ubuntu.com/security/CVE-2020-15664 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6829 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15666 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15666 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15670 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4474-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12401 · Vendor Advisory