CVE-2020-15680: If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed...

Summary

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerabil...

What to do

Update mozilla firefox to version 82.0 or later.

Affected software

Vendor	Product	Affected versions
mozilla	firefox	< 82.0 `cpe:2.3:a:mozilla:firefox::::::::`

Original advisory text

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed...

If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler. This allowed an attacker to successfully probe whether an external protocol handler was registered. This vulnerability affects Firefox < 82.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1658881 Issue Tracking Permissions Required Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-45/ Release Notes Vendor Advisory