CVE-2020-15677

NameCVE-2020-15677
DescriptionBy exploiting an Open Redirect vulnerability on a website, an attacker could have spoofed the site displayed in the download file dialog to show the original site (the one suffering from the open redirect) rather than the site the file was actually downloaded from. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2387-1, DLA-2408-1, DSA-4768-1, DSA-4770-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid134.0.2-3fixed
firefox-esr (PTS)bullseye115.14.0esr-1~deb11u1fixed
bullseye (security)128.6.0esr-1~deb11u3fixed
bookworm128.5.0esr-1~deb12u1fixed
bookworm (security)128.6.0esr-1~deb12u1fixed
sid, trixie128.6.0esr-4fixed
thunderbird (PTS)bullseye1:115.12.0-1~deb11u1fixed
bullseye (security)1:128.6.0esr-1~deb11u1fixed
bookworm1:128.5.0esr-1~deb12u1fixed
bookworm (security)1:128.6.0esr-1~deb12u1fixed
sid, trixie1:128.6.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)81.0-1
firefox-esrsourcestretch78.3.0esr-1~deb9u1DLA-2387-1
firefox-esrsourcebuster78.3.0esr-1~deb10u1DSA-4768-1
firefox-esrsource(unstable)78.3.0esr-1
thunderbirdsourcestretch1:78.3.1-2~deb9u1DLA-2408-1
thunderbirdsourcebuster1:78.3.1-2~deb10u2DSA-4770-1
thunderbirdsource(unstable)1:78.3.1-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2020-42/#CVE-2020-15677
https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/#CVE-2020-15677
https://www.mozilla.org/en-US/security/advisories/mfsa2020-44/#CVE-2020-15677

Search for package or bug name: Reporting problems