CVE-2020-15678: Debian Linux

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

When recursing through graphical layers while scrolling, an iterator may have become invalid, resulting in a potential use-after-free. This occurs because the function APZCTreeManager::ComputeClippedCompositionBounds did not follow iterator invalidation rules. This vulnerability affects Firefox < 81, Thunderbird < 78.3, and Firefox ESR < 78.3.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Mozilla Firefox: before 81.0 (fixed in 81.0)
• Mozilla Firefox ESR: before 78.3 (fixed in 78.3)
• Mozilla Thunderbird: before 78.3 (fixed in 78.3)
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-10-01. Last modified 2026-06-17.