PT-2020-6714 · Mozilla+6 · Firefox+8

Anne Van Kesteren · Published 2020-07-28 · Updated 2024-12-12 · CVE-2020-15653

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 78.1 Firefox versions prior to 79 Thunderbird versions prior to 78.1

Description A security issue was found in the iframe sandbox element with the allow-popups flag, which could be bypassed when using noopener links. This could lead to security problems for websites that rely on sandbox configurations allowing popups and hosting arbitrary content. The vulnerability is related to incorrect default access permission settings.

Recommendations For Firefox ESR versions prior to 78.1, update to version 78.1 or later. For Firefox versions prior to 79, update to version 79 or later. For Thunderbird versions prior to 78.1, update to version 78.1 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-264

Related Identifiers

ALT-PU-2020-2466

ALT-PU-2020-2598

ALT-PU-2020-2709

ALT-PU-2020-2933

ALT-PU-2020-2934

ALT-PU-2020-3442

ALT-PU-2021-1368

ALT-PU-2021-1369

ALT-PU-2021-2725

ALT-PU-2021-2881

ALT-PU-2021-3368

ALT-PU-2021-3369

ALT-PU-2022-1781

BDU:2022-05735

CESA-2020_3557

CVE-2020-15653

OPENSUSE-SU-2020:1147-1

OPENSUSE-SU-2020:1155-1

OPENSUSE-SU-2020:1189-1

OPENSUSE-SU-2020_1147-1

OPENSUSE-SU-2020_1155-1

OPENSUSE-SU-2020_1189-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2020:3555

RHSA-2020:3557

RHSA-2020:3559

RHSA-2020:4080

RHSA-2020_3557

RHSA-2020_4080

SUSE-SU-2020:14456-1

SUSE-SU-2020:2100-1

SUSE-SU-2020:2118-1

SUSE-SU-2020:2147-1

USN-4443-1

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Linuxmint

Red Hat

Suse

Thunderbird

Ubuntu

References · 1916

• https://linux.oracle.com/errata/ELSA-2020-3557.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15653 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15656 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-32 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-30 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1521542 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-30 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15655 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14456-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15653 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1147-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15652 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-15653 · Vendor Advisory