CVE-2020-6800
Published: 11 February 2020
Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.
Priority
Medium
CVSS 3 base score: 8.8
Status
| Package | Release | Status |
|---|---|---|
|
firefox Launchpad, Ubuntu, Debian |
Upstream |
Released
(73.0)
|
| Ubuntu 21.10 (Impish Indri) |
Released
(73.0+build3-0ubuntu1)
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Released
(73.0+build3-0ubuntu1)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Released
(73.0+build3-0ubuntu1)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(73.0+build3-0ubuntu0.18.04.1)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Released
(73.0.1+build1-0ubuntu0.16.04.1)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
firefox-esr Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.10 (Impish Indri) |
Does not exist
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Does not exist
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Does not exist
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
mozjs38 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.10 (Impish Indri) |
Does not exist
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Does not exist
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Does not exist
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Needs triage
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
mozjs52 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.10 (Impish Indri) |
Does not exist
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Does not exist
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Needs triage
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Needs triage
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
mozjs60 Launchpad, Ubuntu, Debian |
Upstream |
Needs triage
|
| Ubuntu 21.10 (Impish Indri) |
Does not exist
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Does not exist
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Does not exist
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Does not exist
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Does not exist
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
|
|
thunderbird Launchpad, Ubuntu, Debian |
Upstream |
Released
(68.5.0)
|
| Ubuntu 21.10 (Impish Indri) |
Released
(1:68.5.0+build1-0ubuntu1)
|
|
| Ubuntu 21.04 (Hirsute Hippo) |
Released
(1:68.5.0+build1-0ubuntu1)
|
|
| Ubuntu 20.04 LTS (Focal Fossa) |
Released
(1:68.5.0+build1-0ubuntu1)
|
|
| Ubuntu 18.04 LTS (Bionic Beaver) |
Released
(1:68.7.0+build1-0ubuntu0.18.04.1)
|
|
| Ubuntu 16.04 ESM (Xenial Xerus) |
Released
(1:68.7.0+build1-0ubuntu0.16.04.2)
|
|
| Ubuntu 14.04 ESM (Trusty Tahr) |
Does not exist
|
Notes
| Author | Note |
|---|---|
| tyhicks | mozjs contains a copy of the SpiderMonkey JavaScript engine |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6800
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-05/#CVE-2020-6800
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-06/#CVE-2020-6800
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-07/#CVE-2020-6800
- https://ubuntu.com/security/notices/USN-4278-1
- https://ubuntu.com/security/notices/USN-4278-2
- https://ubuntu.com/security/notices/USN-4328-1
- https://ubuntu.com/security/notices/USN-4335-1
- NVD
- Launchpad
- Debian