Every CVE Search/ Get API key

CVE-2020-15663

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would...

8.8 HighFix available

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.72%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Record
CVE-2020-15663
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-427
Updated
2026-11-02
CVE List No score

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Record
CVE-2020-15663
Updated
2026-11-02
EUVDEUVD-2020-7650 No score

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Record
EUVD-2020-7650
Updated
2026-11-03
GitHub AdvisoriesGHSA-fj34-jgxp-cv4f 8.8

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would...

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Record
GHSA-fj34-jgxp-cv4f
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-269, CWE-427
Updated
2026-11-02
OSVALPINE-CVE-2020-15663 8.8

If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is signed by Mozilla, the version could have been rolled back to a previous version which would have allowed exploitation of an older bug and arbitrary code execution with System Privileges. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, and Firefox ESR < 78.2.

Record
ALPINE-CVE-2020-15663
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVopenSUSE-SU-2020:1383-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird was updated to 68.12 (bsc#1175686)

  • CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege

  • CVE-2020-15664: Attacker-induced prompt for extension installation

  • CVE-2020-15669: Use-After-Free when aborting an operation

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1383-1
Updated
2026-11-02
Show 11 moreShow less
OSVopenSUSE-SU-2020:1384-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.2.0 ESR

    • Fixed: Various stability, functionality, and security fixes

  • Mozilla Firefox ESR 78.2 MFSA 2020-38 (bsc#1175686)

    • CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
    • CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation
    • CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626, bmo#1656957) Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

  • Fixed Firefox tab crash in FIPS mode (bsc#1174284).

  • Fix broken translation-loading (bsc#1173991)

    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1384-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1391-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.2.0 ESR

    • Fixed: Various stability, functionality, and security fixes

  • Mozilla Firefox ESR 78.2 MFSA 2020-38 (bsc#1175686)

    • CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
    • CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation
    • CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626, bmo#1656957) Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

  • Fixed Firefox tab crash in FIPS mode (bsc#1174284).

  • Fix broken translation-loading (bsc#1173991)

    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1391-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:1392-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird was updated to 68.12 (bsc#1175686)

  • CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege

  • CVE-2020-15664: Attacker-induced prompt for extension installation

  • CVE-2020-15669: Use-After-Free when aborting an operation

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:1392-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2020:14489-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.2.0 ESR

    • Fixed: Various stability, functionality, and security fixes

  • Mozilla Firefox ESR 78.2 MFSA 2020-38 (bsc#1175686)

    • CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
    • CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation
    • CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626, bmo#1656957) Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

  • Fixed Firefox tab crash in FIPS mode (bsc#1174284).

Record
SUSE-SU-2020:14489-1
Updated
2026-11-02
OSVSUSE-SU-2020:2544-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.2.0 ESR

    • Fixed: Various stability, functionality, and security fixes

  • Mozilla Firefox ESR 78.2 MFSA 2020-38 (bsc#1175686)

    • CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
    • CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation
    • CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626, bmo#1656957) Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

  • Fixed Firefox tab crash in FIPS mode (bsc#1174284).

  • Fix broken translation-loading. (bsc#1173991)

    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

Record
SUSE-SU-2020:2544-1
Updated
2026-11-02
OSVSUSE-SU-2020:2552-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

  • Mozilla Thunderbird was updated to 68.12 (bsc#1175686)

  • CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege

  • CVE-2020-15664: Attacker-induced prompt for extension installation

  • CVE-2020-15669: Use-After-Free when aborting an operation

Record
SUSE-SU-2020:2552-1
Updated
2026-11-02
OSVSUSE-SU-2020:2563-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.2.0 ESR

    • Fixed: Various stability, functionality, and security fixes

  • Mozilla Firefox ESR 78.2 MFSA 2020-38 (bsc#1175686)

    • CVE-2020-15663 (bmo#1643199) Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
    • CVE-2020-15664 (bmo#1658214) Attacker-induced prompt for extension installation
    • CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626, bmo#1656957) Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

  • Fixed Firefox tab crash in FIPS mode (bsc#1174284).

  • Fix broken translation-loading (bsc#1173991)

    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

Record
SUSE-SU-2020:2563-1
Updated
2026-11-02
OSVSUSE-SU-2020:2749-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox was updated to 78.3.0 ESR (bsc#1176756, MFSA 2020-43)

    • CVE-2020-15677: Download origin spoofing via redirect
    • CVE-2020-15676: Fixed an XSS when pasting attacker-controlled data into a contenteditable element
    • CVE-2020-15678: When recursing through layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free scenario
    • CVE-2020-15673: Fixed memory safety bugs

  • Enhance fix for wayland-detection (bsc#1174420)

  • Attempt to fix langpack-parallelization by introducing separate obj-dirs for each lang (bsc#1173986, bsc#1167976)

  • Firefox was updated to 78.2.0 ESR (bsc#1175686, MFSA 2020-38)

    • CVE-2020-15663: Downgrade attack on the Mozilla Maintenance Service could have resulted in escalation of privilege
    • CVE-2020-15664: Attacker-induced prompt for extension installation
    • CVE-2020-15670: Fixed memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2

  • Fixed Firefox tab crash in FIPS mode (bsc#1174284).

  • Fixed broken translation-loading (bsc#1173991)

    • allow addon sideloading
    • mark signatures for langpacks non-mandatory
    • do not autodisable user profile scopes

  • Google API key is not usable for geolocation service any more

Record
SUSE-SU-2020:2749-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.12
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.13
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.14
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.15
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.16
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.17
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.18
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.19
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.20
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.21
 78.0 up to 80.0-r0
80.0-r0
Show 48 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.22
 78.0 up to 80.0-r0
80.0-r0
firefox
Alpine:v3.23
 78.0 up to 80.0-r0
80.0-r0
firefox-esr
Alpine:v3.12
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.13
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.14
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.15
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.16
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.17
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.18
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.19
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.20
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.21
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.22
 before 78.2.0-r0
78.2.0-r0
firefox-esr
Alpine:v3.23
 before 78.2.0-r0
78.2.0-r0
librewolf
Alpine:v3.21
 before 80.0-r0
80.0-r0
librewolf
Alpine:v3.22
 before 80.0-r0
80.0-r0
librewolf
Alpine:v3.23
 before 80.0-r0
80.0-r0
librewolf
Alpine:v3.24
 before 80.0-r0
80.0-r0
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 3 CVEs
 before 78.2.0-78.90.2
78.2.0-78.90.2
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:OpenStack Cloud 9
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 3 CVEs
 before 78.2.0-112.19.2
78.2.0-112.19.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 3 CVEs
 before 68.12.0-3.94.1
68.12.0-3.94.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 3 CVEs
 before 68.12.0-3.94.1
68.12.0-3.94.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 3 CVEs
 before 78.2.0-3.105.1
78.2.0-3.105.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 7 CVEs
 before 78.3.0-8.6.1
78.3.0-8.6.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 68.12.0-lp151.2.50.1
68.12.0-lp151.2.50.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 3 CVEs
 before 78.2.0-lp151.2.65.1
78.2.0-lp151.2.65.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 78.2.0-lp152.2.18.1
78.2.0-lp152.2.18.1
MozillaThunderbird
openSUSE:Leap 15.2
From an advisory covering 3 CVEs
 before 68.12.0-lp152.2.10.1
68.12.0-lp152.2.10.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-15663 is a high vulnerability (CVSS 8.8) in Mozilla Firefox, published September 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.72%, the 86th percentile. Fixed in firefox 80.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,775 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open