CVE-2020-26971: Buffer Overflow
Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow on some video drivers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 84 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 78.6 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 84.0.1-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 78.6.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 84.0.1-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 78.6.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-26971?
CVE-2020-26971 is a vulnerability in certain video drivers in Mozilla Firefox, Thunderbird, and Firefox ESR that can lead to a heap buffer overflow.
How does CVE-2020-26971 occur?
CVE-2020-26971 occurs when certain blit values provided by the user are not properly constrained, resulting in a heap buffer overflow.
Which software is affected by CVE-2020-26971?
Mozilla Firefox versions up to 84, Thunderbird versions up to 78.6, and Firefox ESR versions up to 78.6 are affected by CVE-2020-26971.
What is the severity of CVE-2020-26971?
CVE-2020-26971 has a severity rating of high with a value of 7.
How can I fix CVE-2020-26971?
To fix CVE-2020-26971, update Mozilla Firefox to version 84, Thunderbird to version 78.6, or Firefox ESR to version 78.6.