CVE-2020-6819: high-severity vulnerability in Mozilla Thunderbird
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Firefox and Thunderbird have a memory error that happens when the application closes certain internal objects. An attacker can exploit this timing flaw to crash the browser or potentially run malicious code.
A use-after-free vulnerability in the nsDocShell destructor occurs due to a race condition during object cleanup. Exploitation requires specific conditions to be met during browser shutdown; successful exploitation can lead to arbitrary code execution with user privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.