CVE-2020-15658

MEDIUM

Firefox < 79.0 and Firefox ESR < 78.1 - File Extension Spoofing via Special Character Handling

Title source: llm
STIX 2.1

Description

The code for downloading files did not properly take care of special characters, which led to an attacker being able to cut off the file ending at an earlier position, leading to a different file type being downloaded than shown in the dialog. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

References (6)

Core 6
Core References
Issue Tracking, Permissions Required, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1637745
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4443-1/

Scores

CVSS v3 6.5
EPSS 0.0049
EPSS Percentile 65.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-754
Status published
Products (6)
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 20.04
mozilla/firefox < 79.0
mozilla/firefox_esr < 78.1
mozilla/thunderbird < 78.1
Published Aug 10, 2020
Tracked Since Feb 18, 2026