CVE-2020-15678: Use After Free
When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-15678?
CVE-2020-15678 is classified as a high severity vulnerability due to the potential for a use-after-free condition which can lead to application crashes or code execution.
How do I fix CVE-2020-15678?
To fix CVE-2020-15678, update to the latest version of Firefox or Firefox ESR recommended in the associated patches.
Which versions are affected by CVE-2020-15678?
CVE-2020-15678 affects several versions of Firefox, Firefox ESR, and Thunderbird prior to their respective patched versions.
What happens if CVE-2020-15678 is exploited?
Exploitation of CVE-2020-15678 could allow an attacker to execute arbitrary code, potentially compromising user data and system integrity.
Is there a workaround for CVE-2020-15678?
There are no known workarounds for CVE-2020-15678; the best course of action is to apply the necessary software updates.