CVE-2020-15668

MediumCVSS 4.3/10Last modified Aug 19, 2026

Description

A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-667

Affected software

No affected versions have been published.

Timeline

Published
Oct 1, 2020
Last modified
Aug 19, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-156698.8When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a useCVE-2020-15674.2A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitraCVE-2020-156708.8Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption anCVE-2020-156713.1When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the inputCVE-2020-156738.8Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corrCVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presumeCVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. ThiCVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed aCVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN userCVE-2020-15687.5A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could co
CVE-2020-15668: Medium severity, CVSS 4.3 | Vulnix