CVE-2020-12425: Medium severity Mozilla Thunderbird vulnerability
Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have occurred, leading to potential information disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 78 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 137.0.2-1 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 78.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 78.0-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-12425.
What software products are affected by this vulnerability?
Mozilla Firefox version up to 78 and Mozilla Thunderbird version up to 78 are affected by this vulnerability.
What is the severity of CVE-2020-12425?
The severity of CVE-2020-12425 is low.
What is the potential impact of this vulnerability?
This vulnerability could lead to potential information disclosure.
How can I fix CVE-2020-12425?
To fix CVE-2020-12425, update to a version of Mozilla Firefox or Mozilla Thunderbird that is higher than 78.