CVE-2020-15659
📋 TL;DR
CVE-2020-15659 is a memory corruption vulnerability in Mozilla Firefox and Thunderbird that could allow attackers to execute arbitrary code. The vulnerability affects Firefox versions before 79, Firefox ESR before 68.11 and 78.1, and Thunderbird before 68.11 and 78.1. Attackers could exploit this by tricking users into visiting malicious websites or opening crafted content.
💻 Affected Systems
- Mozilla Firefox
- Mozilla Firefox ESR
- Mozilla Thunderbird
📦 What is this software?
Firefox by Mozilla
Firefox Esr by Mozilla
Firefox Esr by Mozilla
Leap by Opensuse
Leap by Opensuse
Thunderbird by Mozilla
Thunderbird by Mozilla
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the current user, potentially leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Browser crash or denial of service, with potential for limited code execution if combined with other vulnerabilities.
If Mitigated
No impact if systems are patched or if vulnerable browsers are not used to access untrusted content.
🎯 Exploit Status
Memory corruption vulnerabilities typically require some exploitation development effort, but Firefox's widespread use makes this an attractive target.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firefox 79, Firefox ESR 68.11, Firefox ESR 78.1, Thunderbird 68.11, Thunderbird 78.1
Vendor Advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2020-32/
Restart Required: Yes
Instructions:
1. Open Firefox/Thunderbird. 2. Click menu → Help → About Firefox/Thunderbird. 3. The browser will check for updates and prompt to install. 4. Restart the application after update completes.
🔧 Temporary Workarounds
Disable JavaScript
allTemporarily disable JavaScript to reduce attack surface while patching
In Firefox: about:config → javascript.enabled = false
Use alternative browser
allSwitch to a non-vulnerable browser until patches are applied
🧯 If You Can't Patch
- Restrict browser usage to trusted websites only
- Implement application whitelisting to prevent execution of unknown binaries
🔍 How to Verify
Check if Vulnerable:
Check browser version in Help → About Firefox/Thunderbird and compare against affected versionsCheck Version:
firefox --version (Linux) or check About dialog (Windows/macOS)Verify Fix Applied:
Verify version is Firefox ≥79, Firefox ESR ≥68.11 or ≥78.1, Thunderbird ≥68.11 or ≥78.1📡 Detection & Monitoring
Log Indicators:
- Browser crash reports with memory access violations
- Unexpected browser process termination
Network Indicators:
- Connections to known malicious domains that may host exploit code
SIEM Query:
source="firefox.log" AND ("crash" OR "segmentation fault" OR "access violation")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.html
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1550133%2C1633880%2C1643613%2C1644839%2C1645835%2C1646006%2C1646787%2C1649347%2C1650811%2C1651678
- https://usn.ubuntu.com/4443-1/
- https://www.mozilla.org/security/advisories/mfsa2020-30/
- https://www.mozilla.org/security/advisories/mfsa2020-31/
- https://www.mozilla.org/security/advisories/mfsa2020-32/
- https://www.mozilla.org/security/advisories/mfsa2020-33/
- https://www.mozilla.org/security/advisories/mfsa2020-35/
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.html
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1550133%2C1633880%2C1643613%2C1644839%2C1645835%2C1646006%2C1646787%2C1649347%2C1650811%2C1651678
- https://usn.ubuntu.com/4443-1/
- https://www.mozilla.org/security/advisories/mfsa2020-30/
- https://www.mozilla.org/security/advisories/mfsa2020-31/
- https://www.mozilla.org/security/advisories/mfsa2020-32/
- https://www.mozilla.org/security/advisories/mfsa2020-33/
- https://www.mozilla.org/security/advisories/mfsa2020-35/
