Information disclosure in Mozilla Firefox - CVE-2020-15666
Published: August 25, 2020
Vulnerability identifier: #VU46021
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-15666
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output in an MediaError message. When trying to load a non-video in an audio/video context the exact status code (200, 302, 404, 500, 412, 403, etc.) was disclosed via the MediaError Message. This level of information leakage is inconsistent with the standardized onerror/onsuccess disclosure and can lead to inferring login status to services or device discovery on a local network among other attacks.
Affected software
Mozilla Firefox
Ubuntu
Firefox for Android
firefox (Alpine package)
firefox (Ubuntu package)
Ubuntu
Firefox for Android
firefox (Alpine package)
firefox (Ubuntu package)
How to mitigate CVE-2020-15666
Install updates from vendor's website.
Mozilla Firefox - update to 80.0
Firefox for Android - update to 80.1.2
firefox (Ubuntu package) - addressed in versions 80.0+build2-0ubuntu0.16.04.1, 80.0+build2-0ubuntu0.18.04.1, 80.0+build2-0ubuntu0.20.04.1, 80.0.1+build1-0ubuntu0.16.04.1, 80.0.1+build1-0ubuntu0.18.04.1, 80.0.1+build1-0ubuntu0.20.04.1
Firefox for Android - update to 80.1.2
firefox (Ubuntu package) - addressed in versions 80.0+build2-0ubuntu0.16.04.1, 80.0+build2-0ubuntu0.18.04.1, 80.0+build2-0ubuntu0.20.04.1, 80.0.1+build1-0ubuntu0.16.04.1, 80.0.1+build1-0ubuntu0.18.04.1, 80.0.1+build1-0ubuntu0.20.04.1