#VU46016 Resource management error in Mozilla Firefox and Firefox ESR - CVE-2020-15664
Published: August 25, 2020 / Updated: August 26, 2020
Vulnerability identifier: #VU46016
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-15664
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mozilla Firefox
Firefox ESR
Mozilla Firefox
Firefox ESR
Software vendor:
Mozilla
Mozilla
Description
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to the way Firefox handles prompts. By holding a reference to the eval() function from an
about:blank window, a malicious webpage could have gained access to the
InstallTrigger object which would allow them to prompt the user to
install an extension. Combined with user confusion, this could result in
an unintended or malicious extension being installed.
Remediation
Install updates from vendor's website.