CVE-2020-26956: XSS
Published Nov 17, 2020
·Updated
In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS.
Affected Software
42 affected componentsFixes available
Mozilla Thunderbird<78.5
78.5
Mozilla Firefox<83.0
Mozilla Firefox ESR<78.5
Mozilla Thunderbird<78.5
Mozilla Firefox<83
83
Mozilla Firefox ESR<78.5
78.5
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox<83.0-r0
83.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/firefox-esr<78.5.0-r0
78.5.0-r0
alpine/librewolf<83.0-r0
83.0-r0
alpine/librewolf<83.0-r0
83.0-r0
alpine/librewolf<83.0-r0
83.0-r0
alpine/librewolf<83.0-r0
83.0-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
alpine/thunderbird<78.5.1-r0
78.5.1-r0
Event History
Nov 17, 2020
CVE Published
12:00 AM
Dec 9, 2020
CVE Published
via MITRE·12:21 AM
Data Sourced
via MITRE·12:21 AM
DescriptionWeakness
Data Sourced
via NVD·01:15 AM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·01:15 AM
DescriptionSeverityAffected Software
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-26956.
2
What is the affected software?
The affected software includes Mozilla Firefox ESR version up to 78.5, Mozilla Firefox version up to 83, and Mozilla Thunderbird version up to 78.5.
3
What is the severity of CVE-2020-26956?
The severity of CVE-2020-26956 is medium (severity value: 4).
4
How does CVE-2020-26956 affect the software?
CVE-2020-26956 can lead to XSS (cross-site scripting) by allowing existing SVG event handlers to remain after removing HTML elements during sanitization.
5
How can I fix CVE-2020-26956?
To fix CVE-2020-26956, update to the appropriate version of Mozilla Firefox ESR or Mozilla Thunderbird.