VDB
CVE-2020-26970
CVE-2020-26970
PUBLISHED
CVSS 8.800000190734863 HIGH
When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1.
EPSS 1.25% · 67.5th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
1.25%
67.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | thunderbird | *, 1:52.9.1+build3-0ubuntu0.18.04.1, 1:60.2.1+build1-0ubuntu0.18.04.2 |
| Ubuntu:20.04:LTS | thunderbird | 1:68.1.2+build1-0ubuntu1, 1:68.1.2+build1-0ubuntu2, 1:68.2.1+build1-0ubuntu1 |
Timeline
- Dec 2, 2020 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Jan 6, 2022 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Jul 5, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Nov 9, 2022 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-26970 third-party-advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-53/#CVE-2020-26970 third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1677338 third-party-advisory
- https://ubuntu.com/security/notices/USN-4701-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-26970 third-party-advisory