CVE-2020-6820: high-severity vulnerability in Mozilla Thunderbird
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A race condition in ReadableStream handling can cause Firefox or Thunderbird to crash or run malicious code when processing certain data. Attackers are already using this flaw to target users.
A race condition in ReadableStream processing allows use-after-free memory access under specific timing conditions. Exploitation requires a crafted input processed by the vulnerable component; successful exploitation can lead to arbitrary code execution or denial of service.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.