6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.006 Low
EPSS
Percentile
77.9%
Severity: High
Date : 2020-09-23
CVE-ID : CVE-2020-15673 CVE-2020-15674 CVE-2020-15675 CVE-2020-15676
CVE-2020-15677 CVE-2020-15678
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1235
The package firefox before version 81.0-1 is vulnerable to multiple
issues including arbitrary code execution, content spoofing, cross-site
scripting and denial of service.
Upgrade to 81.0-1.
The problems have been fixed upstream in version 81.0.
None.
Several memory safety issues have been found in Firefox before 81.0 and
Firefox ESR 78.3. Some of these bugs showed evidence of memory
corruption and Mozilla presumes that with enough effort some of these
could have been exploited to run arbitrary code.
Several memory safety issues have been found in Firefox before 81.0.
Some of these bugs showed evidence of memory corruption and Mozilla
presumes that with enough effort some of these could have been
exploited to run arbitrary code.
A use-after-free issue has been found in the WebGL implementation of
Firefox before 81.0 where, when processing surfaces, the lifetime may
outlive a persistent buffer leading to memory corruption and a
potentially exploitable crash.
Firefox before 81.0 sometimes ran the onload handler for SVG elements
that the DOM sanitizer decided to remove, resulting in JavaScript being
executed after pasting attacker-controlled data into a content-editable
element.
An issue has been found in Firefox before 81.0 where, by exploiting an
Open Redirect vulnerability on a website, an attacker could have
spoofed the site displayed in the download file dialog to show the
original site (the one suffering from the open redirect) rather than
the site the file was actually downloaded from.
A use-after-free issue has been found in Firefox before 81.0 where,
when recursing through graphical layers while scrolling, an iterator
may have become invalid, resulting in a potential use-after-free. This
occurs because the function
APZCTreeManager::ComputeClippedCompositionBounds did not follow
iterator invalidation rules.
A remote attacker might be able to cause a crash, spoof content or
execute arbitrary code.
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15673
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1648493%2C1660800
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15674
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1656063%2C1656064%2C1656067%2C1660293
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15675
https://bugzilla.mozilla.org/show_bug.cgi?id=1654211
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15676
https://bugzilla.mozilla.org/show_bug.cgi?id=1646140
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15677
https://bugzilla.mozilla.org/show_bug.cgi?id=1641487
https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15678
https://bugzilla.mozilla.org/show_bug.cgi?id=1660211
https://security.archlinux.org/CVE-2020-15673
https://security.archlinux.org/CVE-2020-15674
https://security.archlinux.org/CVE-2020-15675
https://security.archlinux.org/CVE-2020-15676
https://security.archlinux.org/CVE-2020-15677
https://security.archlinux.org/CVE-2020-15678
bugzilla.mozilla.org/buglist.cgi?bug_id=1648493%2C1660800
bugzilla.mozilla.org/buglist.cgi?bug_id=1656063%2C1656064%2C1656067%2C1660293
bugzilla.mozilla.org/show_bug.cgi?id=1641487
bugzilla.mozilla.org/show_bug.cgi?id=1646140
bugzilla.mozilla.org/show_bug.cgi?id=1654211
bugzilla.mozilla.org/show_bug.cgi?id=1660211
security.archlinux.org/AVG-1235
security.archlinux.org/CVE-2020-15673
security.archlinux.org/CVE-2020-15674
security.archlinux.org/CVE-2020-15675
security.archlinux.org/CVE-2020-15676
security.archlinux.org/CVE-2020-15677
security.archlinux.org/CVE-2020-15678
www.mozilla.org/en-US/security/advisories/mfsa2020-42
www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15673
www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15674
www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15675
www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15676
www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15677
www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15678
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.006 Low
EPSS
Percentile
77.9%