CVE-2020-15667

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key. This vulnerability affects Firefox < 80.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156684.3A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects CVE-2020-156698.8When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use CVE-2020-15674.2A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitra CVE-2020-156708.8Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption an CVE-2020-156713.1When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input CVE-2020-156738.8Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corr CVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. Thi CVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed a CVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user