CVE-2020-15658: 
NixOS vulnerability analysis and mitigation

CVE-2020-15658 is a security vulnerability discovered in Mozilla Firefox, Firefox ESR, and Thunderbird that was disclosed on July 28, 2020. The vulnerability affected Firefox ESR < 78.1, Firefox < 79, and Thunderbird < 78.1. The issue involved improper handling of special characters in file downloads, where the code did not properly handle null characters in filenames (Mozilla Advisory, NVD).

The vulnerability stems from the browser's file download functionality not properly handling special characters, particularly null characters, in filenames. When a file was downloaded with a filename containing null characters, the browser would truncate the filename at the null character position, potentially resulting in a different file extension than what was displayed in the download dialog. The vulnerability has a CVSS v3.1 Base Score of 6.5 (Medium) with attack vector being Network, attack complexity Low, and requiring user interaction (Ubuntu).

The vulnerability could allow an attacker to trick users into downloading files with unexpected file types. By manipulating the filename with null characters, an attacker could make a file appear to have one extension in the download dialog while actually saving it with a different, potentially dangerous extension on disk. This could lead to unexpected code execution if the user later opened the file expecting it to be of the type shown in the dialog (Mozilla Advisory).

The vulnerability requires user interaction to exploit, as the user must be tricked into downloading a specially crafted file. The attack can be initiated through a malicious website that prompts a download with a manipulated filename. The vulnerability was rated as having low severity by Mozilla, though it could potentially lead to code execution if successfully exploited (Mozilla Advisory, Ubuntu).

The vulnerability was fixed in Firefox 79.0, Firefox ESR 78.1, and Thunderbird 78.1. The fix involved replacing null characters with underscores in filenames, similar to the approach taken by Chrome. Users should update to these versions or later to mitigate the vulnerability. The fix was also backported to various Ubuntu releases, including Ubuntu 20.04 LTS, 18.04 LTS, and 16.04 LTS (Ubuntu USN, Mozilla Advisory).