CVE-2020-15670
Summary
| CVE | CVE-2020-15670 |
|---|---|
| State | PUBLISHED |
| Assigner | mozilla |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-10-01 19:15:13 UTC |
| Updated | 2026-08-19 15:29:21 UTC |
| Description | Mozilla developers reported memory safety bugs present in Firefox for Android 79. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 80, Firefox ESR < 78.2, Thunderbird < 78.2, and Firefox for Android < 80. |
Risk And Classification
Primary CVSS: v3.1 8.8 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.010770000 probability, percentile 0.623690000 (date 2026-08-19)
Problem Types: CWE-362 | CWE-416 | CWE-617 | Memory safety bugs fixed in Firefox for Android 80
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox Esr | All | All | All | All |
| Application | Mozilla | Firefox Mobile | All | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Mozilla | Firefox | affected unspecified 80 custom | Not specified |
| CNA | Mozilla | Firefox ESR | affected unspecified 78.2 custom | Not specified |
| CNA | Mozilla | Thunderbird | affected unspecified 78.2 custom | Not specified |
| CNA | Mozilla | Firefox For Android | affected unspecified 80 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Vulnerabilities fixed in Firefox 80 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Release Notes, Vendor Advisory |
| Bug List | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.mozilla.org | Broken Link, Issue Tracking, Vendor Advisory |
| Security Vulnerabilities fixed in Firefox ESR 78.2 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Release Notes, Vendor Advisory |
| Security Vulnerabilities fixed in Thunderbird 78.2 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Release Notes, Vendor Advisory |
| Security Vulnerabilities fixed in Firefox for Android 80 — Mozilla | af854a3a-2127-422b-91ae-364da2661108 | www.mozilla.org | Release Notes, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.