CVE-2020-26973: High severity Mozilla Thunderbird vulnerability
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 78.6 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 84 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 78.6 - Upgrade
Upgrade
alpine/firefoxto a version that resolves this vulnerability.Fixed in 84.0.1-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 78.6.0-r0 - Upgrade
Upgrade
alpine/librewolfto a version that resolves this vulnerability.Fixed in 84.0.1-r0 - Upgrade
Upgrade
alpine/thunderbirdto a version that resolves this vulnerability.Fixed in 78.6.1-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2020-26973?
The severity of CVE-2020-26973 is categorized as moderate.
How do I fix CVE-2020-26973?
To fix CVE-2020-26973, update to Mozilla Firefox version 85 or later.
Which versions of Mozilla software are affected by CVE-2020-26973?
CVE-2020-26973 affects Mozilla Firefox versions prior to 85, Firefox ESR versions prior to 78.6, and Thunderbird versions prior to 78.6.
Can CVE-2020-26973 be exploited remotely?
Yes, CVE-2020-26973 can potentially be exploited remotely through crafted input.
What is the nature of the vulnerability in CVE-2020-26973?
CVE-2020-26973 is a sanitizer bypass vulnerability that confuses the CSS Sanitizer, leading to incorrect components being removed.