CVE-2020-26972: Use After Free
The lifecycle of IPC Actors allows managed actors to outlive their manager actors; and the former must ensure that they are not attempting to use a dead actor they have a reference to. Such a check was omitted in WebGL, resulting in a use-after-free and a potentially exploitable crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 84 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 84.0.1-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 84.0.1-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-26972?
CVE-2020-26972 is rated as a high severity vulnerability due to its potential to cause crashes and exploitation.
How do I fix CVE-2020-26972?
To fix CVE-2020-26972, users should update Mozilla Firefox to version 84 or later.
Which versions of Firefox are affected by CVE-2020-26972?
CVE-2020-26972 affects Mozilla Firefox versions prior to 84.
What type of vulnerability is CVE-2020-26972?
CVE-2020-26972 is classified as a use-after-free vulnerability.
Can CVE-2020-26972 be exploited remotely?
Yes, CVE-2020-26972 could potentially be exploited remotely through specially crafted content.