cbcvebase.
CVE-2020-6820
published 2020-04-24

CVE-2020-6820: Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing…

PriorityP180high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-05-03
Exploited in the wild
EPSS
6.30%
92.7th percentile
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.

Affected

16 ranges
VendorProductVersion rangeFixed in
debianfirefox< firefox 74.0.1-1 (sid)firefox 74.0.1-1 (sid)
debianfirefox-esr< firefox 74.0.1-1 (sid)firefox 74.0.1-1 (sid)
debianthunderbird< firefox 74.0.1-1 (sid)firefox 74.0.1-1 (sid)
mozillafirefox< 68.6.168.6.1
mozillafirefox< 74.0.174.0.1
mozillafirefox
mozillafirefox>= unspecified < 74.0.174.0.1
mozillafirefox_esr>= unspecified < 68.6.168.6.1
mozillathunderbird< 68.7.068.7.0
mozillathunderbird>= 0 < 1:68.7.0-11:68.7.0-1
mozillathunderbird>= 0 < 1:68.7.0-11:68.7.0-1
mozillathunderbird>= 0 < 1:68.7.0-11:68.7.0-1
mozillathunderbird>= 0 < 1:68.7.0-11:68.7.0-1
mozillathunderbird>= 0 < 1:68.7.0+build1-0ubuntu0.16.04.21:68.7.0+build1-0ubuntu0.16.04.2
mozillathunderbird>= 0 < 1:68.7.0+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.1
mozillathunderbird>= unspecified < 68.7.068.7.0

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2020-6820 is a use-after-free triggered by a race condition in the ReadableStream class; monitor for exploitation of ReadableStream handling in Firefox/Thunderbird processes
  • Both CVE-2020-6819 and CVE-2020-6820 are use-after-free issues that can lead to RCE; treat any unexplained Firefox/Thunderbird crash or memory corruption as a potential exploitation indicator
  • Exploitation was observed in targeted attacks in the wild; prioritize detection on endpoints running Firefox < 74.0.1, Firefox ESR < 68.6.1, or Thunderbird < 68.7.0
  • ·No proof-of-concept code was publicly available at the time of initial disclosure; exploitation details were withheld pending researcher publication and possible cross-browser impact

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vulncheck8.1HIGH
cisa8.1HIGH
vendor_ubuntu8.8HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.