Resource management error in Mozilla Firefox - CVE-2020-15681
Published: October 20, 2020
Vulnerability identifier: #VU47744
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-15681
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper management of internal resources within the application when processing multiple WASM threads. When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table. Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on the system.
Affected software
Mozilla Firefox
Arch Linux
Ubuntu
firefox (Alpine package)
firefox (Ubuntu package)
Arch Linux
Ubuntu
firefox (Alpine package)
firefox (Ubuntu package)
How to mitigate CVE-2020-15681
Install updates from vendor's website.
Mozilla Firefox - update to 82.0
firefox (Ubuntu package) - addressed in versions 82.0+build2-0ubuntu0.16.04.5, 82.0+build2-0ubuntu0.18.04.1, 82.0+build2-0ubuntu0.20.04.1, 82.0+build2-0ubuntu0.20.10.1
firefox (Ubuntu package) - addressed in versions 82.0+build2-0ubuntu0.16.04.5, 82.0+build2-0ubuntu0.18.04.1, 82.0+build2-0ubuntu0.20.04.1, 82.0+build2-0ubuntu0.20.10.1