PT-2020-19225 · Mozilla+5 · Thunderbird+5

Chiaki Ishikawa · Published 2020-02-11 · Updated 2024-06-15 · CVE-2020-6792

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.5

Description The issue arises when deriving an identifier for an email message, where uninitialized memory is used in addition to the message contents.

Recommendations For versions prior to 68.5, update to version 68.5 or later to resolve the issue.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-909

CWE-908

Related Identifiers

ALT-PU-2020-1182

ALT-PU-2020-1515

CESA-2020_0574

CESA-2020_0576

CESA-2020_0577

CVE-2020-6792

DLA-2104-1

DSA-4625-1

MGASA-2020-0091

OPENSUSE-SU-2020:0231-1

OPENSUSE-SU-2020_0231-1

OPENSUSE-SU-2024:10601-1

RHSA-2020:0565

RHSA-2020:0574

RHSA-2020:0576

RHSA-2020:0577

RHSA-2020_0574

RHSA-2020_0576

RHSA-2020_0577

SUSE-SU-2020:0385-1

USN-4328-1

USN-4335-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 470

• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://ubuntu.com/security/CVE-2020-6795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6792 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-6792 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17017 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17012 · Vendor Advisory
• https://usn.ubuntu.com/4328-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6794 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4625-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6792 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory