CVE-2020-26971: Buffer Overflow

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1663466
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-54/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-55/
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-56/
• https://www.mozilla.org/security/advisories/mfsa2020-54/
• https://www.mozilla.org/security/advisories/mfsa2020-55/
• https://www.mozilla.org/security/advisories/mfsa2020-56/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2020-55
• MFSA2020-56
• MFSA2020-54

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2020-16042
• CVE-2020-26971
• CVE-2020-26973
• CVE-2020-26974
• CVE-2020-26978
• CVE-2020-35111
• CVE-2020-35112
• CVE-2020-35113
• CVE-2020-26972
• CVE-2020-26975
• CVE-2020-26976
• CVE-2020-26977
• CVE-2020-26979
• CVE-2020-35114

Frequently Asked Questions

• What is CVE-2020-26971?

  CVE-2020-26971 is a vulnerability in certain video drivers in Mozilla Firefox, Thunderbird, and Firefox ESR that can lead to a heap buffer overflow.

• How does CVE-2020-26971 occur?

  CVE-2020-26971 occurs when certain blit values provided by the user are not properly constrained, resulting in a heap buffer overflow.

• Which software is affected by CVE-2020-26971?

  Mozilla Firefox versions up to 84, Thunderbird versions up to 78.6, and Firefox ESR versions up to 78.6 are affected by CVE-2020-26971.

• What is the severity of CVE-2020-26971?

  CVE-2020-26971 has a severity rating of high with a value of 7.

• How can I fix CVE-2020-26971?

  To fix CVE-2020-26971, update Mozilla Firefox to version 84, Thunderbird to version 78.6, or Firefox ESR to version 78.6.