PT-2020-14582 · Mozilla+6 · Firefox+8

Lukas Bernhard · Published 2020-09-22 · Updated 2024-12-12 · CVE-2020-15678

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 81 Thunderbird versions prior to 78.3 Firefox ESR versions prior to 78.3

Description A potential use-after-free issue occurs due to an iterator becoming invalid when recursing through graphical layers while scrolling. This is caused by the function APZCTreeManager::ComputeClippedCompositionBounds not following iterator invalidation rules.

Recommendations For Firefox versions prior to 81, update to version 81 or later. For Thunderbird versions prior to 78.3, update to version 78.3 or later. For Firefox ESR versions prior to 78.3, update to version 78.3 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2020-2871

ALT-PU-2020-2876

ALT-PU-2020-2889

ALT-PU-2020-2933

ALT-PU-2020-2934

ALT-PU-2021-1152

ALT-PU-2021-1368

ALT-PU-2021-1369

ALT-PU-2021-2725

ALT-PU-2021-2881

ALT-PU-2021-3368

ALT-PU-2021-3369

ALT-PU-2022-1781

CESA-2020_3832

CESA-2020_4155

CVE-2020-15678

DLA-2387-1

DLA-2387-2

DLA-2408-1

DSA-4768-1

DSA-4770-1

MGASA-2020-0377

MGASA-2020-0378

OPENSUSE-SU-2020:1555-1

OPENSUSE-SU-2020:1574-1

OPENSUSE-SU-2020:1780-1

OPENSUSE-SU-2020:1785-1

OPENSUSE-SU-2020_1555-1

OPENSUSE-SU-2020_1574-1

OPENSUSE-SU-2020_1780-1

OPENSUSE-SU-2020_1785-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

RHSA-2020:3832

RHSA-2020:3833

RHSA-2020:3834

RHSA-2020:3835

RHSA-2020:4080

RHSA-2020:4155

RHSA-2020:4156

RHSA-2020:4157

RHSA-2020:4158

RHSA-2020:4163

RHSA-2020_3832

RHSA-2020_3835

RHSA-2020_4080

RHSA-2020_4155

RHSA-2020_4158

RHSA-2020_4163

SUSE-SU-2020:14502-1

SUSE-SU-2020:2747-1

SUSE-SU-2020:2749-1

SUSE-SU-2020:2759-1

SUSE-SU-2020:3091-1

USN-4546-1

USN-4546-2

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Suse

Thunderbird

Ubuntu

References · 2064

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/mistymntncop/CVE-2022-26485 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15678 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15677 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4546-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15678 · Vendor Advisory