CVE-2020-15667: High severity Mozilla Firefox vulnerability
When processing a MAR update file, after the signature has been validated, an invalid name length could result in a heap overflow, leading to memory corruption and potentially arbitrary code execution. Within Firefox as released by Mozilla, this issue is only exploitable with the Mozilla-controlled signing key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 80 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 80.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 80.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-15667?
CVE-2020-15667 is a vulnerability in Mozilla Firefox that could lead to memory corruption and potentially arbitrary code execution.
How does CVE-2020-15667 occur?
CVE-2020-15667 occurs when processing a MAR update file after the signature has been validated, where an invalid name length could result in a heap overflow.
Is Mozilla Firefox affected by CVE-2020-15667?
Yes, Mozilla Firefox up to version 80.0 is affected by CVE-2020-15667.
What is the severity of CVE-2020-15667?
CVE-2020-15667 has a high severity rating with a CVSS score of 8.8.
What is the CWE ID of CVE-2020-15667?
The CWE ID of CVE-2020-15667 is 787.