CVE-2020-15684 Use after free in Firefox
Memory safety bugs in Firefox allow attackers to execute arbitrary code via memory corruption, requiring users to upgrade to version 82.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15684?
CVE-2020-15684 is a critical use after free vulnerability in Mozilla Firefox, published on 22 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 82.
Weakness: CWE-416
Which versions are affected by CVE-2020-15684?
It affects 1 product.
Products include Mozilla Firefox.
How do I fix CVE-2020-15684?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-15684 being exploited?
There is no known exploitation of CVE-2020-15684 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as GHSA-w65j-fpvf-v9rw, UBUNTU-CVE-2020-15684.