Insecure DLL loading in Mozilla Firefox and Firefox ESR - CVE-2020-15657
Published: July 29, 2020
Vulnerability identifier: #VU32904
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-15657
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner from the installation directory. A remote attacker can place a specially crafted .dll file into directory, from which Firefox is being installed, trick the victim into launching the Firefox installer and execute arbitrary code on the system.
Affected software
Mozilla Firefox
Firefox ESR
Slackware Linux
Opensuse
Mozilla Thunderbird
firefox-esr (Alpine package)
firefox (Alpine package)
Firefox ESR
Slackware Linux
Opensuse
Mozilla Thunderbird
firefox-esr (Alpine package)
firefox (Alpine package)
How to mitigate CVE-2020-15657
Install updates from vendor's website.
Mozilla Firefox - update to 79.0
Firefox ESR - update to 78.1.0
Mozilla Thunderbird - update to 78.0.1
firefox-esr (Alpine package) - update to 78.1.0-r0
firefox (Alpine package) - update to 79.0-r0
Firefox ESR - update to 78.1.0
Mozilla Thunderbird - update to 78.0.1
firefox-esr (Alpine package) - update to 78.1.0-r0
firefox (Alpine package) - update to 79.0-r0
External References
Related Security Bulletins
- Multiple vulnerabilities in Mozilla Firefox
- Multiple vulnerabilities in Mozilla Thunderbird
- OpenSUSE Linux update for MozillaFirefox
- OpenSUSE Linux update for MozillaFirefox
- OpenSUSE Linux update for MozillaFirefox
- Insecure DLL loading in firefox-esr (Alpine package)
- Insecure DLL loading in firefox (Alpine package)