CVE-2020-15668

MediumCVSS 4.3/10Last modified Aug 19, 2026

Description

A lock was missing when accessing a data structure and importing certificate information into the trust database. This vulnerability affects Firefox < 80 and Firefox for Android < 80.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-667

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 80
Mozilla	Firefox for Android	>= unspecified, < 80

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1651520Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-36/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-39/Release Notes, Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1651520Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-36/Release Notes, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-39/Release Notes, Vendor Advisory

Timeline

Published: Oct 1, 2020
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156698.8When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use CVE-2020-15674.2A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitra CVE-2020-156708.8Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption an CVE-2020-156713.1When typing in a password under certain conditions, a race may have occured where the InputContext was not being correctly set for the input CVE-2020-156738.8Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corr CVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. Thi CVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed a CVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user CVE-2020-15687.5A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could co