CVE-2020-15685: Command Injection

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1622640
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/
• https://www.mozilla.org/security/advisories/mfsa2021-05/
• https://www.mozilla.org/en-US/security/advisories/mfsa2021-05/#CVE-2020-15685
• https://security-tracker.debian.org/tracker/CVE-2020-15685

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2021-05

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2021-23953
• CVE-2021-23954
• CVE-2020-15685
• CVE-2020-26976
• CVE-2021-23960
• CVE-2021-23964

Frequently Asked Questions

• What is the severity of CVE-2020-15685?

  CVE-2020-15685 has a medium severity level due to potential command injection vulnerabilities during the STARTTLS setup.

• How do I fix CVE-2020-15685?

  To fix CVE-2020-15685, upgrade to versions of Thunderbird that are not affected, specifically 78.7.0 or later.

• Which versions of Thunderbird are affected by CVE-2020-15685?

  CVE-2020-15685 affects Thunderbird versions prior to 78.7.0.

• What type of vulnerability is CVE-2020-15685?

  CVE-2020-15685 is a command injection vulnerability during the plaintext phase of the STARTTLS connection.

• Is CVE-2020-15685 specific to any particular operating system?

  CVE-2020-15685 primarily affects the Mozilla Thunderbird email client across various operating systems.