VulnerabilityModified
CVE-2020-15656
This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
HIGH 8.8EPSS 1.51%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.51%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.51% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-843
- Affected
- mozilla/firefox · mozilla/firefox esr · mozilla/thunderbird · opensuse/leap · canonical/ubuntu linux
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1647293Issue Tracking, Permissions Required, Vendor Advisory
- https://usn.ubuntu.com/4443-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-30/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-32/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-33/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1647293Issue Tracking, Permissions Required, Vendor Advisory
- https://usn.ubuntu.com/4443-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-30/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-32/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-33/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.