{
  "cveId": "CVE-2020-15254",
  "url": "https://patchblox.com/security/cve/CVE-2020-15254",
  "summary": "CVE-2020-15254 is fixed in 3 products on 1 platform, first by firefox 82.0\u002Bbuild2-0ubuntu0.18.04.1, released October 21, 2020. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "firefox: Crossbeam is a set of tools for concurrent programming",
  "description": "Crossbeam is a set of tools for concurrent programming. Incrossbeam-channel before version 0.4.4, the bounded channel incorrectlyassumes that \u0060Vec::from_iter\u0060 has allocated capacity that same as thenumber of iterator elements. \u0060Vec::from_iter\u0060 does not actually guaranteethat and may allocate extra memory. The destructor of the \u0060bounded\u0060 channelreconstructs \u0060Vec\u0060 from the raw pointer based on the incorrect assumesdescribed above. This is unsound and causing deallocation with theincorrect capacity when \u0060Vec::from_iter\u0060 has allocated different sizes withthe number of iterator elements. This has been fixed in crossbeam-channel0.4.4.",
  "published": "2020-10-21T17:00:00Z",
  "severity": "Medium",
  "epss": 0.02701,
  "epssPercentile": 0.86021,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "82.0\u002Bbuild2-0ubuntu0.18.04.1",
      "fix": "firefox 82.0\u002Bbuild2-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-82.0-build2-0ubuntu0.18.04.1",
      "released": "2020-10-21T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "82.0\u002Bbuild2-0ubuntu0.20.04.1",
      "fix": "firefox 82.0\u002Bbuild2-0ubuntu0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-82.0-build2-0ubuntu0.20.04.1",
      "released": "2020-10-21T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "82.0.2\u002Bbuild1-0ubuntu1",
      "fix": "firefox 82.0.2\u002Bbuild1-0ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-firefox-82.0.2-build1-0ubuntu1",
      "released": "2020-10-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "82.0.2\u002Bbuild1-0ubuntu1",
      "fix": "firefox 82.0.2\u002Bbuild1-0ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-firefox-82.0.2-build1-0ubuntu1",
      "released": "2020-10-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-geckodriver",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "82.0\u002Bbuild2-0ubuntu0.18.04.1",
      "fix": "firefox-geckodriver 82.0\u002Bbuild2-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-geckodriver-82.0-build2-0ubuntu0.18.04.1",
      "released": "2020-10-21T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-geckodriver",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "82.0\u002Bbuild2-0ubuntu0.20.04.1",
      "fix": "firefox-geckodriver 82.0\u002Bbuild2-0ubuntu0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-geckodriver-82.0-build2-0ubuntu0.20.04.1",
      "released": "2020-10-21T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "82.0\u002Bbuild2-0ubuntu0.18.04.1",
      "fix": "firefox-mozsymbols 82.0\u002Bbuild2-0ubuntu0.18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-firefox-mozsymbols-82.0-build2-0ubuntu0.18.04.1",
      "released": "2020-10-21T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "firefox-mozsymbols",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "82.0\u002Bbuild2-0ubuntu0.20.04.1",
      "fix": "firefox-mozsymbols 82.0\u002Bbuild2-0ubuntu0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-firefox-mozsymbols-82.0-build2-0ubuntu0.20.04.1",
      "released": "2020-10-21T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}