CVE-2020-6822: High severity Mozilla Firefox vulnerability

Q: What is CVE-2020-6822?

CVE-2020-6822 is a vulnerability that allows an out-of-bounds write when processing large images in Mozilla Thunderbird and Firefox.

Q: How does CVE-2020-6822 affect Thunderbird and Firefox?

CVE-2020-6822 affects Thunderbird versions prior to 68.7.0 and Firefox ESR versions prior to 68.7. This vulnerability allows arbitrary code execution.

Q: What is the severity of CVE-2020-6822?

CVE-2020-6822 has a severity score of 8.8, which is considered high.

Q: How can I fix CVE-2020-6822?

To fix CVE-2020-6822, update Thunderbird to version 68.7.0 or later, and Firefox ESR to version 68.7 or later.

Q: Where can I find more information about CVE-2020-6822?

You can find more information about CVE-2020-6822 in the references provided: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1544181), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/), and [MITRE CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6822).

Published Apr 7, 2020

Updated

Last updated 25 August 2025

Other sources

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

— Launchpad

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in GMPDecodeData. It is possible that with enough effort this could have been exploited to run arbitrary code.

Affected Software

9 affected componentsFixes available

Mozilla Firefox<75

Mozilla Thunderbird<68.7

68.7

Mozilla Firefox<75.0

Mozilla Firefox ESR<68.7.0

Mozilla Thunderbird<68.7.0

Mozilla Firefox ESR<68.7

68.7

debian/firefox

152.0.6-1

debian/firefox-esr

115.14.0esr-1~deb11u1140.13.0esr-1~deb11u1140.12.0esr-1~deb12u1140.13.0esr-1~deb12u1140.12.0esr-1~deb13u1140.13.0esr-1~deb13u1140.12.0esr-1140.13.0esr-2

debian/thunderbird

1:115.12.0-1~deb11u11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.12.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 75
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 68.7
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 68.7
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 152.0.6-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 140.13.0esr-1~deb11u1Fixed in 140.12.0esr-1~deb12u1Fixed in 140.13.0esr-1~deb12u1Fixed in 140.12.0esr-1~deb13u1Fixed in 140.13.0esr-1~deb13u1Fixed in 140.12.0esr-1Fixed in 140.13.0esr-2
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.12.0esr-1~deb11u1Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:140.12.0esr-1
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 68.7.0
Upgrade
Upgrade Mozilla Firefox ESR to a version that resolves this vulnerability.
Fixed in 68.7
Upgrade
Upgrade Mozilla Firefox to a version that resolves this vulnerability.
Fixed in 75

Event History

Apr 7, 2020

CVE Published

12:00 AM

Apr 24, 2020

CVE Published

via MITRE·03:54 PM

Data Sourced

via MITRE·03:54 PM

DescriptionWeakness

Data Sourced

via NVD·04:15 PM

DescriptionSeverityWeaknessAffected Software

Jan 11, 2024

Data Sourced

via Launchpad·11:52 PM

Description

Feb 23, 2026

Data Sourced

via Ubuntu·03:19 PM

RemedyDescriptionSeverityAffected Software

Jul 24, 2026

Data Sourced

via Debian·04:21 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2020-6822?

CVE-2020-6822 is a vulnerability that allows an out-of-bounds write when processing large images in Mozilla Thunderbird and Firefox.

How does CVE-2020-6822 affect Thunderbird and Firefox?

CVE-2020-6822 affects Thunderbird versions prior to 68.7.0 and Firefox ESR versions prior to 68.7. This vulnerability allows arbitrary code execution.

What is the severity of CVE-2020-6822?

CVE-2020-6822 has a severity score of 8.8, which is considered high.

How can I fix CVE-2020-6822?

To fix CVE-2020-6822, update Thunderbird to version 68.7.0 or later, and Firefox ESR to version 68.7 or later.

Where can I find more information about CVE-2020-6822?

You can find more information about CVE-2020-6822 in the references provided: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1544181), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-12/), and [MITRE CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6822).

CVE-2020-6822: High severity Mozilla Firefox vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2020-6822?

How does CVE-2020-6822 affect Thunderbird and Firefox?

What is the severity of CVE-2020-6822?

How can I fix CVE-2020-6822?

Where can I find more information about CVE-2020-6822?

Company

Resources

Contact