CVE-2020-15656 - Mozilla: Type confusion for special arguments in IonMonkey

Back Back to CVE browser

HIGH

Mozilla: Type confusion for special arguments in IonMonkey

Published Aug 10, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.51%

Description

JIT optimizations involving the Javascript arguments object could confuse later optimizations. This risk was already mitigated by various precautions in the code, resulting in this bug rated at only moderate severity. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <79
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <78.1
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <78.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<79

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<78.1

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<78.1

Red Hat Enterprise Linux 7

firefox-0:78.3.0-1.el7_9

Fixed · RHSA-2020:4080
Red Hat Enterprise Linux 8

firefox-0:78.2.0-2.el8_2

Fixed · RHSA-2020:3557
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

firefox-0:78.2.0-3.el8_0

Fixed · RHSA-2020:3555
Red Hat Enterprise Linux 8.1 Extended Update Support

firefox-0:78.2.0-3.el8_1

Fixed · RHSA-2020:3559
Red Hat Enterprise Linux 5

firefox

Not affected
Red Hat Enterprise Linux 5

thunderbird

Out of support scope
Red Hat Enterprise Linux 6

firefox

Out of support scope
Red Hat Enterprise Linux 6

thunderbird

Out of support scope
Red Hat Enterprise Linux 7

thunderbird

Will not fix
Red Hat Enterprise Linux 8

thunderbird

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	firefox-0:78.3.0-1.el7_9	Fixed	RHSA-2020:4080
Red Hat Enterprise Linux 8	firefox-0:78.2.0-2.el8_2	Fixed	RHSA-2020:3557
Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions	firefox-0:78.2.0-3.el8_0	Fixed	RHSA-2020:3555
Red Hat Enterprise Linux 8.1 Extended Update Support	firefox-0:78.2.0-3.el8_1	Fixed	RHSA-2020:3559
Red Hat Enterprise Linux 5	firefox	Not affected	n/a
Red Hat Enterprise Linux 5	thunderbird	Out of support scope	n/a
Red Hat Enterprise Linux 6	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 6	thunderbird	Out of support scope	n/a
Red Hat Enterprise Linux 7	thunderbird	Will not fix	n/a
Red Hat Enterprise Linux 8	thunderbird	Will not fix	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-843

References (11)

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
vendor-advisoryx_refsource_SUSEThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-15656
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1647293
x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1861646
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2020-15656
https://usn.ubuntu.com/4443-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-15656
https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15656
https://www.mozilla.org/security/advisories/mfsa2020-30/
x_refsource_MISCVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-32/
x_refsource_MISCVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-33/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html		vendor-advisoryx_refsource_SUSEThird Party Advisory
https://access.redhat.com/security/cve/CVE-2020-15656		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1647293		x_refsource_MISCIssue TrackingPermissions RequiredVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1861646		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2020-15656
https://usn.ubuntu.com/4443-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-15656
https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15656
https://www.mozilla.org/security/advisories/mfsa2020-30/		x_refsource_MISCVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-32/		x_refsource_MISCVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2020-33/		x_refsource_MISCVendor Advisory