{"id":"CVE-2020-15648","aliases":["EUVD-2020-7635","GHSA-jrmg-2w74-rwc9","MGASA-2020-0378","RHSA-2020:3555","RHSA-2020:3557","RHSA-2020:3559","RHSA-2020:4080","UBUNTU-CVE-2020-15648"],"status":"published","title":"Using object or embed tags, it was possible to frame other websites, even if they disallowed...","description":"Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird \u003c 78 and Firefox \u003c 78.0.2.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01142,"percentile":0.66916,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1021"],"published":"2020-08-10T17:43:24Z","modified":"2026-06-26T10:50:48Z","fixes":[{"ecosystem":"Ubuntu:16.04:LTS","package":"firefox","fixed_in":["79.0+build1-0ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"firefox","fixed_in":["79.0+build1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","fixed_in":["1:78.8.1+build1-0ubuntu0.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"firefox","fixed_in":["79.0+build1-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","fixed_in":["1:78.7.1+build1-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.3.1-3.mga7"}]}],"bundled":11},{"source":"osv","ecosystem":"Mageia:7","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"78.3.1-1.mga7"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.0::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-3.el8_0"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-2.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-2.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-2.el8_2"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-3.el8_1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-3.el8_1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.2.0-3.el8_1"}]}],"bundled":10},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.3.0-1.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.3.0-1.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.3.0-1.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.3.0-1.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.3.0-1.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:78.3.0-1.el7_9"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"79.0+build1-0ubuntu0.16.04.2"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2","54.0+build3-0ubuntu0.16.04.1","55.0.1+build2-0ubuntu0.16.04.2","55.0.2+build1-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.2","57.0+build4-0ubuntu0.16.04.5","57.0+build4-0ubuntu0.16.04.6","57.0.1+build2-0ubuntu0.16.04.1","57.0.3+build1-0ubuntu0.16.04.1","57.0.4+build1-0ubuntu0.16.04.1","58.0+build6-0ubuntu0.16.04.1","58.0.1+build1-0ubuntu0.16.04.1","58.0.2+build1-0ubuntu0.16.04.1","59.0+build5-0ubuntu0.16.04.1","59.0.1+build1-0ubuntu0.16.04.1","59.0.2+build1-0ubuntu0.16.04.1","59.0.2+build1-0ubuntu0.16.04.3","60.0+build2-0ubuntu0.16.04.1","60.0.1+build2-0ubuntu0.16.04.1","60.0.2+build1-0ubuntu0.16.04.1","61.0+build3-0ubuntu0.16.04.2","61.0.1+build1-0ubuntu0.16.04.1","62.0+build2-0ubuntu0.16.04.3","62.0+build2-0ubuntu0.16.04.4","62.0+build2-0ubuntu0.16.04.5","62.0.3+build1-0ubuntu0.16.04.2","63.0+build2-0ubuntu0.16.04.2","63.0.3+build1-0ubuntu0.16.04.1","64.0+build3-0ubuntu0.16.04.1","65.0+build2-0ubuntu0.16.04.1","65.0.1+build2-0ubuntu0.16.04.1","66.0+build3-0ubuntu0.16.04.2","66.0.1+build1-0ubuntu0.16.04.1","66.0.2+build1-0ubuntu0.16.04.1","66.0.3+build1-0ubuntu0.16.04.1","66.0.4+build3-0ubuntu0.16.04.1","66.0.5+build1-0ubuntu0.16.04.1","67.0+build2-0ubuntu0.16.04.1","67.0.1+build1-0ubuntu0.16.04.1","67.0.2+build2-0ubuntu0.16.04.1","67.0.3+build1-0ubuntu0.16.04.1","67.0.4+build1-0ubuntu0.16.04.1","68.0+build3-0ubuntu0.16.04.1","68.0.1+build1-0ubuntu0.16.04.1","68.0.2+build1-0ubuntu0.16.04.1","69.0+build2-0ubuntu0.16.04.4","69.0.1+build1-0ubuntu0.16.04.1","69.0.2+build1-0ubuntu0.16.04.1","70.0+build2-0ubuntu0.16.04.1","70.0.1+build1-0ubuntu0.16.04.1","71.0+build5-0ubuntu0.16.04.1","72.0.1+build1-0ubuntu0.16.04.1","72.0.2+build1-0ubuntu0.16.04.1","73.0.1+build1-0ubuntu0.16.04.1","74.0+build3-0ubuntu0.16.04.1","74.0.1+build1-0ubuntu0.16.04.1","75.0+build3-0ubuntu0.16.04.1","76.0+build2-0ubuntu0.16.04.1","76.0.1+build1-0ubuntu0.16.04.1","77.0.1+build1-0ubuntu0.16.04.1","78.0.1+build1-0ubuntu0.16.04.1","78.0.2+build2-0ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"79.0+build1-0ubuntu0.18.04.1"}]}],"versions":["56.0+build6-0ubuntu1","57.0.1+build2-0ubuntu1","59.0.1+build1-0ubuntu1","59.0.2+build1-0ubuntu1","60.0+build2-0ubuntu1","60.0.1+build2-0ubuntu0.18.04.1","60.0.2+build1-0ubuntu0.18.04.1","61.0+build3-0ubuntu0.18.04.1","61.0.1+build1-0ubuntu0.18.04.1","62.0+build2-0ubuntu0.18.04.3","62.0+build2-0ubuntu0.18.04.4","62.0+build2-0ubuntu0.18.04.5","62.0.3+build1-0ubuntu0.18.04.1","63.0+build2-0ubuntu0.18.04.2","63.0.3+build1-0ubuntu0.18.04.1","64.0+build3-0ubuntu0.18.04.1","65.0+build2-0ubuntu0.18.04.1","65.0.1+build2-0ubuntu0.18.04.1","66.0+build3-0ubuntu0.18.04.1","66.0.1+build1-0ubuntu0.18.04.1","66.0.2+build1-0ubuntu0.18.04.1","66.0.3+build1-0ubuntu0.18.04.1","66.0.4+build3-0ubuntu0.18.04.1","66.0.5+build1-0ubuntu0.18.04.1","67.0+build2-0ubuntu0.18.04.1","67.0.1+build1-0ubuntu0.18.04.1","67.0.2+build2-0ubuntu0.18.04.1","67.0.3+build1-0ubuntu0.18.04.1","67.0.4+build1-0ubuntu0.18.04.1","68.0+build3-0ubuntu0.18.04.1","68.0.1+build1-0ubuntu0.18.04.1","68.0.2+build1-0ubuntu0.18.04.1","69.0+build2-0ubuntu0.18.04.1","69.0.1+build1-0ubuntu0.18.04.1","69.0.2+build1-0ubuntu0.18.04.1","70.0+build2-0ubuntu0.18.04.1","70.0.1+build1-0ubuntu0.18.04.1","71.0+build5-0ubuntu0.18.04.1","72.0.1+build1-0ubuntu0.18.04.1","72.0.2+build1-0ubuntu0.18.04.1","73.0+build3-0ubuntu0.18.04.1","73.0.1+build1-0ubuntu0.18.04.1","74.0+build3-0ubuntu0.18.04.1","74.0.1+build1-0ubuntu0.18.04.1","75.0+build3-0ubuntu0.18.04.1","76.0+build2-0ubuntu0.18.04.1","76.0.1+build1-0ubuntu0.18.04.1","77.0.1+build1-0ubuntu0.18.04.1","78.0.1+build1-0ubuntu0.18.04.1","78.0.2+build2-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.8.1+build1-0ubuntu0.18.04.1"}]}],"versions":["1:52.4.0+build1-0ubuntu2","1:52.6.0+build1-0ubuntu1","1:52.7.0+build1-0ubuntu1","1:52.8.0+build1-0ubuntu0.18.04.1","1:52.9.1+build3-0ubuntu0.18.04.1","1:60.2.1+build1-0ubuntu0.18.04.2","1:60.4.0+build2-0ubuntu0.18.04.1","1:60.5.1+build2-0ubuntu0.18.04.1","1:60.6.1+build2-0ubuntu0.18.04.1","1:60.7.0+build1-0ubuntu0.18.04.1","1:60.7.1+build1-0ubuntu0.18.04.1","1:60.7.2+build2-0ubuntu0.18.04.1","1:60.8.0+build1-0ubuntu0.18.04.1","1:60.9.0+build1-0ubuntu0.18.04.1","1:68.2.1+build1-0ubuntu0.18.04.1","1:68.2.2+build1-0ubuntu0.18.04.1","1:68.4.1+build1-0ubuntu0.18.04.1","1:68.7.0+build1-0ubuntu0.18.04.1","1:68.8.0+build2-0ubuntu0.18.04.2","1:68.10.0+build1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"79.0+build1-0ubuntu0.20.04.1"}]}],"versions":["69.0.3+build1-0ubuntu1","70.0+build2-0ubuntu1","70.0+build2-0ubuntu2","70.0.1+build1-0ubuntu2","71.0+build2-0ubuntu2","71.0+build5-0ubuntu1","72.0.1+build1-0ubuntu1","72.0.2+build1-0ubuntu1","73.0+build1-0ubuntu1","73.0+build2-0ubuntu1","73.0+build3-0ubuntu1","73.0.1+build1-0ubuntu1","74.0+build1-0ubuntu1","74.0+build2-0ubuntu1","74.0+build2-0ubuntu2","74.0+build3-0ubuntu1","75.0+build3-0ubuntu1","76.0+build2-0ubuntu0.20.04.1","76.0.1+build1-0ubuntu0.20.04.1","77.0.1+build1-0ubuntu0.20.04.1","78.0.1+build1-0ubuntu0.20.04.1","78.0.2+build2-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:78.7.1+build1-0ubuntu0.20.04.1"}]}],"versions":["1:68.1.2+build1-0ubuntu1","1:68.1.2+build1-0ubuntu2","1:68.2.1+build1-0ubuntu1","1:68.2.2+build1-0ubuntu1","1:68.3.0+build2-0ubuntu1","1:68.3.1+build1-0ubuntu2","1:68.4.1+build1-0ubuntu1","1:68.4.2+build2-0ubuntu1","1:68.5.0+build1-0ubuntu1","1:68.6.0+build2-0ubuntu1","1:68.7.0+build1-0ubuntu1","1:68.7.0+build1-0ubuntu2","1:68.8.0+build2-0ubuntu0.20.04.2","1:68.10.0+build1-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2020-29/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2020-28/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1644076","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15648","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jrmg-2w74-rwc9"},{"url":"https://advisories.mageia.org/MGASA-2020-0378.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26965","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-29/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-44/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.0.1/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.1.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.1.1/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.2.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.2.1/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.3.0/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/78.3.1/releasenotes/","tags":["web"]},{"url":"https://wiki.mageia.org/en/Migration_from_Thunderbird_68_and_Enigmail_to_Thunderbird_78","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3555","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1861645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1861646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1861647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1861649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1872540","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3555.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12422","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12422","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12424","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12424","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12424","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12424","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12425","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-24/#CVE-2020-12425","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15648","tags":["advisory","report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-28/#CVE-2020-15648","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15653","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15653","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15654","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15654","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15656","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15656","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15656","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15658","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-33/#CVE-2020-15658","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15664","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15664","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-37/#CVE-2020-15664","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15669","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15669","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-37/#CVE-2020-15669","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3557","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3557.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12390","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-16/#CVE-2020-12390","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3559","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3559.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4080","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1868842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881664","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881666","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881667","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4080.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15673","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15673","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15673","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/#CVE-2020-15673","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15676","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15676","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/#CVE-2020-15676","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15677","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/#CVE-2020-15677","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-15678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15678","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2020-43/#CVE-2020-15678","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2020-15648","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15648","description":"Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird \u003c 78 and Firefox \u003c 78.0.2.","status":"published","published":"2020-08-10T17:43:24Z","modified":"2024-08-04T13:22:30.612Z","updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-7635","description":"Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird \u003c 78 and Firefox \u003c 78.0.2.","status":"published","published":"2020-08-10T17:43:24Z","modified":"2024-08-04T13:22:30Z","updated_at":"2026-11-03T03:07:30.980066Z"}],"ghsa":[{"id":"GHSA-jrmg-2w74-rwc9","title":"Using object or embed tags, it was possible to frame other websites, even if they disallowed...","description":"Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird \u003c 78 and Firefox \u003c 78.0.2.","status":"published","published":"2022-05-24T17:25:11Z","modified":"2023-01-29T05:04:04Z","updated_at":"2026-11-02T14:45:28.021412Z"}],"nvd":[{"id":"CVE-2020-15648","description":"Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird \u003c 78 and Firefox \u003c 78.0.2.","status":"published","published":"2020-08-10T18:15:12.06Z","modified":"2026-06-17T02:56:58.72Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1021"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"RHSA-2020:3555","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T04:44:00Z","modified":"2026-01-14T11:02:51.184973Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:3557","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T04:43:44Z","modified":"2026-01-28T10:45:07.683892Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:3559","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2024-09-16T04:43:52Z","modified":"2026-01-14T11:02:51.303669Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:4080","title":"Red Hat Security Advisory: firefox security and bug fix update","status":"published","published":"2024-09-16T04:46:59Z","modified":"2026-06-26T10:50:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-15648","description":"Using object or embed tags, it was possible to frame other websites, even if they disallowed framing using the X-Frame-Options header. This vulnerability affects Thunderbird \u003c 78 and Firefox \u003c 78.0.2.","status":"published","published":"2020-08-10T18:15:00Z","modified":"2026-04-22T12:19:18.364759Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"MGASA-2020-0378","title":"Updated Thunderbird packages fix security vulnerabilities","description":"AppCache manifest poisoning due to url encoded character processing\n(CVE-2020-12415).\n\nUse-after-free in WebRTC VideoBroadcaster (CVE-2020-12416).\n\nInteger overflow in nsJPEGEncoder::emptyOutputBuffer (CVE-2020-12422).\n\nWebRTC permission prompt could have been bypassed by a compromised content\nprocess (CVE-2020-12424).\n\nOut of bound read in Date.parse() (CVE-2020-12425).\n\nMemory safety bugs fixed in Thunderbird 78 (CVE-2020-12426).\n\nX-Frame-Options bypass using object or embed tags (CVE-2020-15648).\n\nMemory safety bugs fixed in Thunderbird 78.3 (CVE-2020-15673).\n\nXSS when pasting attacker-controlled data into a contenteditable element\n(CVE-2020-15676).\n\nDownload origin spoofing via redirect (CVE-2020-15677).\n\nWhen recursing through layers while scrolling, an iterator may have become\ninvalid, resulting in a potential use-after-free scenario (CVE-2020-15678).\n\nNote that Enigmail will no longer let you manage your PGP keys, but\ninstead will only provide a migration tool. Thunderbird will no longer use\nthe system keyring and GnuPG; instead, it will handle PGP keys internally.\n\nTo use your existing PGP keys with Thunderbird 78 and above, you must use the\nmigration tool from Enigmail upon the first Thunderbird run.\nSee the migration notes on the Mageia wiki.\n\nAlso note that, to protect your keys, you should define a master password\nin Thunderbird.\n","status":"published","published":"2020-09-30T10:01:40Z","modified":"2026-04-16T04:41:28.008368648Z","updated_at":"2026-11-02T15:49:41.509337Z"}]}}