Vulnerability Description
An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed popups and hosted arbitrary content. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 79.0 |
| Mozilla | Firefox Esr | < 78.1 |
| Mozilla | Thunderbird | < 78.1 |
| Canonical | Ubuntu Linux | 16.04 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1521542Issue TrackingPermissions RequiredVendor Advisory
- https://usn.ubuntu.com/4443-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-30/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-32/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-33/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1521542Issue TrackingPermissions RequiredVendor Advisory
- https://usn.ubuntu.com/4443-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-30/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-32/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-33/Vendor Advisory
FAQ
What is CVE-2020-15653?
CVE-2020-15653 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. This could have led to security issues for websites relying on sandbox configurations that allowed pop...
How severe is CVE-2020-15653?
CVE-2020-15653 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-15653?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Canonical Ubuntu Linux.