CVE-2020-15673

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Mozilla developers reported memory safety bugs present in Firefox 80 and Firefox ESR 78.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 81
MozillaThunderbird>= unspecified, < 78.3
MozillaFirefox ESR>= unspecified, < 78.3

References

Timeline

Published
Oct 1, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-156748.8Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory corruption and we presumeCVE-2020-156758.8When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. ThiCVE-2020-156766.1Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed aCVE-2020-156776.1By exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to CVE-2020-156788.8When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN userCVE-2020-15687.5A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could coCVE-2020-156805.3If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken imCVE-2020-156817.5When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anothCVE-2020-156826.5When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An aCVE-2020-156839.8Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed eCVE-2020-156849.8Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume
CVE-2020-15673: High severity, CVSS 8.8 | Vulnix