CVE-2020-6826 — Out-of-bounds Write in Mozilla Firefox

CWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents8 sources
Severity
9.8CRITICALNVD
OSV7.5
EPSS
0.5%
top 34.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxDebian Firefox
Timeline
PublishedApr 24
Latest updateMay 24

Description

Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 75.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 75
▶NVDmozilla/firefox< 75.0
▶Ubuntumozilla/firefox< 75.0+build3-0ubuntu0.16.04.1+2
▶mozillamozilla/firefox
▶debiandebian/firefox< firefox 75.0-1 (sid)

🔴Vulnerability Details

3
GHSA
GHSA-qp6r-j328-v2w7: Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74↗2022-05-24
▶
OSV
CVE-2020-6826: Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory safety bugs present in Firefox 74↗2020-04-07
▶
OSV
firefox vulnerabilities↗2020-04-07
▶

📋Vendor Advisories

4
Red Hat
Mozilla: Memory safety bugs fixed in Firefox 75↗2020-04-10
▶
Ubuntu
Firefox vulnerabilities↗2020-04-07
▶
Debian
CVE-2020-6826: firefox - Mozilla developers Tyson Smith, Bob Clary, and Alexandru Michis reported memory ...↗2020
▶
Mozilla
Mozilla Foundation Security Advisory 2020-12: CVE-2020-6826↗
▶

💬Community

1
Bugzilla
CVE-2020-6826 Mozilla: Memory safety bugs fixed in Firefox 75↗2020-04-07
▶