The vulnerability of the Mozilla Firefox ESR browser and the Thunderbird email client relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

🗓️ 21 Sep 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Memory after free flaw in Firefox ESR and Thunderbird allows remote code execution via web page.

Reporter	Title	Published	Views	Family All 149
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities of Mozilla Firefox (less than Firefox 68.12.0 ESR + CVE-2020-15664) hava affected Synthetic Playback Agent 8.1.4.0-8.1.4 IF11 + ICAM2019.3.0 - 2020.2.0	27 Sep 202009:09	–	ibm
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2020-1496)	1 Oct 202000:00	–	nessus
Tenable Nessus	CentOS 8 : firefox (CESA-2020:3557)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 8 : thunderbird (CESA-2020:3634)	1 Feb 202100:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (RHSA-2020:3556)	1 Sep 202000:00	–	nessus
Tenable Nessus	CentOS 6 : firefox (RHSA-2020:3558)	1 Sep 202000:00	–	nessus
Tenable Nessus	CentOS 7 : thunderbird (RHSA-2020:3631)	14 Sep 202000:00	–	nessus
Tenable Nessus	CentOS 6 : thunderbird (RHSA-2020:3643)	14 Sep 202000:00	–	nessus
Tenable Nessus	Debian DLA-2346-1 : firefox-esr security update	28 Aug 202000:00	–	nessus
Tenable Nessus	Debian DLA-2360-1 : thunderbird security update	1 Sep 202000:00	–	nessus

Vulners

Node

mozilla firefox_esrRange<68.12

OR

mozilla thunderbirdRange<68.12

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

OR

novell opensuse_leapMatch15.1

OR

novell opensuse_leapMatch15.2

OR

novell opensuse_leapMatch15.3

OR

novell opensuse_leapMatch15.4

Source	Link
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2020-37/
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2020-40/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-15669
suse	www.suse.com/security/cve/CVE-2020-15669.html
access	www.access.redhat.com/security/cve/cve-2020-15669
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
web	www.web.nvd.nist.gov/view/vuln/detail

21 Nov 2023 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 38.8

CVSS 210

EPSS0.00451

memory corruption use after free firefox thunderbird remote code execution web page exploit