CVE-2020-12416: Race Condition
A VideoStreamEncoder may have been freed in a race condition with VideoBroadcaster::AddOrUpdateSink, resulting in a use-after-free, memory corruption, and a potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 78 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 137.0.2-1 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 78.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 78.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-12416?
CVE-2020-12416 is a vulnerability in Firefox and Thunderbird that could result in a use-after-free, memory corruption, and potentially exploitable crash.
How does CVE-2020-12416 affect Firefox?
CVE-2020-12416 affects Firefox versions prior to 78.0.
How does CVE-2020-12416 affect Thunderbird?
CVE-2020-12416 affects Thunderbird versions prior to 78.0.
What is the severity of CVE-2020-12416?
CVE-2020-12416 has a severity level of critical with a CVSS score of 8.8.
How do I fix CVE-2020-12416 in Firefox and Thunderbird?
To fix CVE-2020-12416, upgrade to Firefox version 78.0 or later, or upgrade to Thunderbird version 78.0 or later.