CVE-2020-15678

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156797.6An OAuth session fixation vulnerability existed in the VPN login flow, where an attacker could craft a custom login URL, convince a VPN user CVE-2020-15687.5A remote code execution vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory. The vulnerability could co CVE-2020-156805.3If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken im CVE-2020-156817.5When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten anoth CVE-2020-156826.5When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An a CVE-2020-156839.8Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed e CVE-2020-156849.8Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume CVE-2020-156858.8During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted s CVE-2020-156877.5Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root ac CVE-2020-156888.8The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an una CVE-2020-156897.5Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact ra CVE-2020-15697.8A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memo