CVE-2020-15683

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 78.4, Firefox < 82, and Thunderbird < 78.4.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416CWE-787

Affected software

VendorProductVersions
MozillaFirefox ESR>= unspecified, < 78.4
MozillaFirefox>= unspecified, < 82
MozillaThunderbird>= unspecified, < 78.4

References

Timeline

Published
Oct 22, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-156849.8Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presumeCVE-2020-156858.8During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted sCVE-2020-156877.5Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a malicious entity, with root acCVE-2020-156888.8The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unaCVE-2020-156897.5Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact raCVE-2020-15697.8A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memoCVE-2020-156909.8In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.CVE-2020-156929.8In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file paCVE-2020-156936.5In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attackerCVE-2020-156947.5In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() CVE-2020-156956.3An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerabCVE-2020-156966.1An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.
CVE-2020-15683: Critical severity, CVSS 9.8 | Vulnix