CVE-2020-26968: Critical severity thunderbird vulnerability
Mozilla developers Randell Jesup, Christian Holler, Jason Kratzer, Byron Campen, and Steve Fink reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Other sources
Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.
Mozilla developers Steve Fink, Jason Kratzer, Randell Jesup, Christian Holler, and Byron Campen reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
Mozilla developers Steve Fink, Jason Kratzer, Randell Jesup, Christian Holler, and Byron Campen reported memory safety bugs present in Thunderbird 78.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2020-26968.
Which software versions are affected by this vulnerability?
Firefox ESR versions up to and excluding 78.5, Thunderbird versions up to and excluding 78.5, and Firefox versions up to and excluding 83 are affected by this vulnerability.
What is the severity of CVE-2020-26968?
The severity of CVE-2020-26968 is high with a CVSS score of 7.
Are there any known fixes for this vulnerability?
Yes, Mozilla has released Firefox ESR version 78.5 and Firefox version 83, which contain fixes for this vulnerability.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability on the Mozilla Bugzilla and Mozilla Security Advisories websites. Links: [Mozilla Bugzilla](https://bugzilla.mozilla.org/buglist.cgi?bug_id=1551615%2C1607762%2C1656697%2C1657739%2C1660236%2C1667912%2C1671479%2C1671923), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/)