Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-15656: JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at onl...
CVE-2020-15656 · published 6 years ago
Summary
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78....
What to do
- Update mozilla firefox to version 79.0 or later.
- Update mozilla firefox_esr to version 78.1 or later.
- Update mozilla thunderbird to version 78.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox |
< 79.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | firefox_esr |
< 78.1 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
| mozilla | thunderbird |
< 78.1 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| opensuse | leap |
15.2 cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* |
| canonical | ubuntu_linux |
16.04 18.04 20.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
Original advisory text
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at onl...
JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1647293 Issue Tracking Permissions Required Vendor Advisory
- https://usn.ubuntu.com/4443-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-30/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-32/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-33/ Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-843Type Confusion
Timeline
Published10 Aug 2020
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2020-15656 · NVD
Track software like this
Free during beta