--- title: "CVE-2020-15664\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2020-15664?format=md keywords: index, follow --- # CVE-2020-15664 Publication date 26 August 2020 Last updated 25 August 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **6.5 · Medium** [Score breakdown](https://ubuntu.com/security/CVE-2020-15664?format=md#impact-score) Toggle side navigation ## Description By holding a reference to the eval() function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious extension being installed. This vulnerability affects Firefox < 80, Thunderbird < 78.2, Thunderbird < 68.12, Firefox ESR < 68.12, Firefox ESR < 78.2, and Firefox for Android < 80. [Read the notes from the security team](https://ubuntu.com/security/CVE-2020-15664?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | mozjs38 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Ignored end of standard support, was needs-triage | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | mozjs52 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Ignored end of life | | 20.04 LTS focal | Ignored | | 18.04 LTS bionic | Ignored end of standard support, was needs-triage | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | firefox | 24.04 LTS noble | Fixed 80.0.1+build1-0ubuntu1 | | 23.10 mantic | Fixed 80.0.1+build1-0ubuntu1 | | 23.04 lunar | Fixed 80.0.1+build1-0ubuntu1 | | 22.10 kinetic | Fixed 80.0.1+build1-0ubuntu1 | | 22.04 LTS jammy | Fixed 80.0.1+build1-0ubuntu1 | | 21.10 impish | Fixed 80.0.1+build1-0ubuntu1 | | 21.04 hirsute | Fixed 80.0.1+build1-0ubuntu1 | | 20.10 groovy | Fixed 80.0.1+build1-0ubuntu1 | | 20.04 LTS focal | Fixed 80.0+build2-0ubuntu0.20.04.1 | | 18.04 LTS bionic | Fixed 80.0+build2-0ubuntu0.18.04.1 | | 16.04 LTS xenial | Fixed 80.0+build2-0ubuntu0.16.04.1 | | 14.04 LTS trusty | Not in release | | firefox-esr | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | mozjs60 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Not in release | | 20.04 LTS focal | Not in release | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | mozjs68 | 24.04 LTS noble | Not in release | | 23.10 mantic | Not in release | | 23.04 lunar | Not in release | | 22.10 kinetic | Not in release | | 22.04 LTS jammy | Not in release | | 21.10 impish | Not in release | | 21.04 hirsute | Not in release | | 20.10 groovy | Ignored end of life | | 20.04 LTS focal | Ignored | | 18.04 LTS bionic | Not in release | | 16.04 LTS xenial | Not in release | | 14.04 LTS trusty | Not in release | | thunderbird | 24.04 LTS noble | Not affected | | 23.10 mantic | Not affected | | 23.04 lunar | Not affected | | 22.10 kinetic | Not affected | | 22.04 LTS jammy | Not affected | | 21.10 impish | Not affected | | 21.04 hirsute | Not affected | | 20.10 groovy | Not affected | | 20.04 LTS focal | Fixed 1:78.7.1+build1-0ubuntu0.20.04.1 | | 18.04 LTS bionic | Fixed 1:78.8.1+build1-0ubuntu0.18.04.1 | | 16.04 LTS xenial | Ignored end of standard support, was needed | | 14.04 LTS trusty | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [tyhicks](https://launchpad.net/~tyhicks) mozjs contains a copy of the SpiderMonkey JavaScript engine ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 6.5 · Medium * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | Required | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | High | | Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 6.5 · Medium | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15664) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-15664) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2020-15664) * [Debian](https://security-tracker.debian.org/tracker/CVE-2020-15664) ### Related Ubuntu Security Notices (USN) + [USN-4474-1](https://usn.ubuntu.com/USN-4474-1) + Firefox vulnerabilities + 26 August 2020 ### Other references * * * * *