CVE-2020-26958: XSS
Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass.
Other sources
Thunderbird did not block execution of scripts with incorrect MIME types when the response was intercepted and cached through a ServiceWorker. This could lead to a cross-site script inclusion vulnerability, or a Content Security Policy bypass.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.5 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 83 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 78.5 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 83.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 78.5.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 83.0-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 78.5.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-26958.
What is the severity of CVE-2020-26958?
The severity of CVE-2020-26958 is medium (4 on a scale of 1-10).
Which software is affected by CVE-2020-26958?
The software affected by CVE-2020-26958 includes Mozilla Firefox ESR version up to 78.5, Mozilla Firefox version up to 83, and Mozilla Thunderbird up to version 78.5.
What is the possible impact of CVE-2020-26958?
CVE-2020-26958 could lead to a cross-site script inclusion vulnerability or a Content Security Policy bypass.
How can I fix CVE-2020-26958?
To fix CVE-2020-26958, update Mozilla Firefox ESR to version 78.5 or later, update Mozilla Firefox to version 83 or later, and update Mozilla Thunderbird to version 78.5 or later.