CVE-2020-26970: High severity Mozilla Thunderbird vulnerability
When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.5.1 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 78.5.1-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-26970?
The CVE-2020-26970 vulnerability has a medium severity rating due to potential stack corruption and exploitation risks.
How do I fix CVE-2020-26970?
To fix CVE-2020-26970, users should upgrade Thunderbird to version 78.5.1 or later.
What versions of Thunderbird are affected by CVE-2020-26970?
CVE-2020-26970 affects all versions of Thunderbird prior to 78.5.1.
Is CVE-2020-26970 exploitable?
Yes, CVE-2020-26970 can lead to stack corruption that may be exploited, depending on the processor architecture and stack layout.
Who is the vendor responsible for CVE-2020-26970?
The vendor responsible for CVE-2020-26970 is Mozilla, the organization behind Thunderbird.