Every CVE Search/ Get API key

CVE-2020-15657

Firefox could be made to load attacker-supplied DLL files from the installation directory. This...

7.8 HighFix available

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.35%Down 12.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Record
CVE-2020-15657
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.9 MediumAV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-427
Updated
2026-11-02
CVE List No score

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Record
CVE-2020-15657
Updated
2026-11-02
EUVDEUVD-2020-7644 No score

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Record
EUVD-2020-7644
Updated
2026-11-03
GitHub AdvisoriesGHSA-vxw8-wvxp-5f2r No score

Firefox could be made to load attacker-supplied DLL files from the installation directory. This...

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Record
GHSA-vxw8-wvxp-5f2r
Updated
2026-11-02
OSVALPINE-CVE-2020-15657 7.8

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1.

Record
ALPINE-CVE-2020-15657
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVopenSUSE-SU-2020:1147-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.1.0 ESR
    • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
    • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
    • CVE-2020-6514: WebRTC data channel leaks internal address to peer
    • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
    • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
    • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
    • CVE-2020-15656: Type confusion for special arguments in IonMonkey
    • CVE-2020-15658: Overriding file type when saving to disk
    • CVE-2020-15657: DLL hijacking due to incorrect loading path
    • CVE-2020-15654: Custom cursor can overlay user interface
    • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1147-1
Updated
2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2020:1155-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.1.0 ESR
    • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
    • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
    • CVE-2020-6514: WebRTC data channel leaks internal address to peer
    • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
    • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
    • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
    • CVE-2020-15656: Type confusion for special arguments in IonMonkey
    • CVE-2020-15658: Overriding file type when saving to disk
    • CVE-2020-15657: DLL hijacking due to incorrect loading path
    • CVE-2020-15654: Custom cursor can overlay user interface
    • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1155-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1189-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

This update for MozillaFirefox and pipewire fixes the following issues:

MozillaFirefox Extended Support Release 78.1.0 ESR

  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308):

  • Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed.
  • Compile fixes
  • Stability improvements in jack and pulseaudio layers.
  • Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions.
  • Improvements to the GStreamer source and sink shutdown.
  • Fix compatibility with v2 clients again when negotiating buffers.

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Record
openSUSE-SU-2020:1189-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2020:14456-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Fix broken translation-loading (boo#1173991)

    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

  • Mozilla Firefox 78.1 ESR

    • Fixed: Various stability, functionality, and security fixe (MFSA 2020-32) (bsc#1174538).
    • CVE-2020-15652 (bmo#1634872) Potential leak of redirect targets when loading scripts in a worker
    • CVE-2020-6514 (bmo#1642792) WebRTC data channel leaks internal address to peer
    • CVE-2020-15655 (bmo#1645204) Extension APIs could be used to bypass Same-Origin Policy
    • CVE-2020-15653 (bmo#1521542) Bypassing iframe sandbox when allowing popups
    • CVE-2020-6463 (bmo#1635293) Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
    • CVE-2020-15656 (bmo#1647293) Type confusion for special arguments in IonMonkey
    • CVE-2020-15658 (bmo#1637745) Overriding file type when saving to disk
    • CVE-2020-15657 (bmo#1644954) DLL hijacking due to incorrect loading path
    • CVE-2020-15654 (bmo#1648333) Custom cursor can overlay user interface
    • CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1643613, bmo#1644839, bmo#1645835, bmo#1646006, bmo#1646787, bmo#1649347, bmo#1650811, bmo#1651678) Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

  • Add sle11-icu-generation-python3.patch to fix icu-generation on big endian platforms

  • Mozilla Firefox 78.0.2 ESR

    • MFSA 2020-28 (bsc#1173948)
    • MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or embed tags
    • Fixed: Fixed an accessibility regression in reader mode (bmo#1650922)
    • Fixed: Made the address bar more resilient to data corruption in the user profile (bmo#1649981)
    • Fixed: Fixed a regression opening certain external applications (bmo#1650162)
Record
SUSE-SU-2020:14456-1
Updated
2026-11-02
OSVSUSE-SU-2020:2100-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.1.0 ESR
    • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
    • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
    • CVE-2020-6514: WebRTC data channel leaks internal address to peer
    • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
    • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
    • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
    • CVE-2020-15656: Type confusion for special arguments in IonMonkey
    • CVE-2020-15658: Overriding file type when saving to disk
    • CVE-2020-15657: DLL hijacking due to incorrect loading path
    • CVE-2020-15654: Custom cursor can overlay user interface
    • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1
Record
SUSE-SU-2020:2100-1
Updated
2026-11-02
OSVSUSE-SU-2020:2118-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.1.0 ESR
    • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
    • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
    • CVE-2020-6514: WebRTC data channel leaks internal address to peer
    • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
    • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
    • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
    • CVE-2020-15656: Type confusion for special arguments in IonMonkey
    • CVE-2020-15658: Overriding file type when saving to disk
    • CVE-2020-15657: DLL hijacking due to incorrect loading path
    • CVE-2020-15654: Custom cursor can overlay user interface
    • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1
Record
SUSE-SU-2020:2118-1
Updated
2026-11-02
OSVSUSE-SU-2020:2147-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

This update for MozillaFirefox and pipewire fixes the following issues:

MozillaFirefox Extended Support Release 78.1.0 ESR

  • Fixed: Various stability, functionality, and security fixes (bsc#1174538)
  • CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
  • CVE-2020-6514: WebRTC data channel leaks internal address to peer
  • CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
  • CVE-2020-15653: Bypassing iframe sandbox when allowing popups
  • CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  • CVE-2020-15656: Type confusion for special arguments in IonMonkey
  • CVE-2020-15658: Overriding file type when saving to disk
  • CVE-2020-15657: DLL hijacking due to incorrect loading path
  • CVE-2020-15654: Custom cursor can overlay user interface
  • CVE-2020-15659: Memory safety bugs fixed in Firefox 79 and Firefox ESR 78.1

pipewire was updated to version 0.3.6 (bsc#1171433, jsc#ECO-2308):

  • Extensive memory leak fixing and stress testing was done. A big leak in screen sharing with DMA-BUF was fixed.
  • Compile fixes
  • Stability improvements in jack and pulseaudio layers.
  • Added the old portal module to make the Camera portal work again. This will be moved to the session manager in future versions.
  • Improvements to the GStreamer source and sink shutdown.
  • Fix compatibility with v2 clients again when negotiating buffers.
Record
SUSE-SU-2020:2147-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.12
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.13
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.14
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.15
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.16
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.17
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.18
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.19
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.20
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.21
 before 79.0-r0
79.0-r0
Show 47 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.22
 before 79.0-r0
79.0-r0
firefox
Alpine:v3.23
 before 79.0-r0
79.0-r0
firefox-esr
Alpine:v3.12
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.13
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.14
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.15
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.16
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.17
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.18
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.19
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.20
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.21
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.22
 before 78.1.0-r0
78.1.0-r0
firefox-esr
Alpine:v3.23
 before 78.1.0-r0
78.1.0-r0
librewolf
Alpine:v3.21
 before 79.0-r0
79.0-r0
librewolf
Alpine:v3.22
 before 79.0-r0
79.0-r0
librewolf
Alpine:v3.23
 before 79.0-r0
79.0-r0
librewolf
Alpine:v3.24
 before 79.0-r0
79.0-r0
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 10 CVEs
 before 78.1.0-78.87.1
78.1.0-78.87.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:OpenStack Cloud 9
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 10 CVEs
 before 78.1.0-112.8.1
78.1.0-112.8.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 10 CVEs
 before 78.1.0-3.100.2
78.1.0-3.100.2
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 10 CVEs
 before 78.1.0-8.3.1
78.1.0-8.3.1
MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 10 CVEs
 before 78-9.2.4
78-9.2.4
pipewire
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 10 CVEs
 before 0.3.6-3.3.2
0.3.6-3.3.2
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 10 CVEs
 before 78.1.0-lp151.2.61.1
78.1.0-lp151.2.61.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 10 CVEs
 before 78.1.0-lp152.2.12.1
78.1.0-lp152.2.12.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 10 CVEs
 before 78.1.0-lp152.2.15.1
78.1.0-lp152.2.15.1
pipewire
openSUSE:Leap 15.2
From an advisory covering 10 CVEs
 before 0.3.6-lp152.2.3.1
0.3.6-lp152.2.3.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15657 is a high vulnerability (CVSS 7.8) in Mozilla Firefox, published July 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in firefox 79.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,680 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open