PT-2020-6731 · Mozilla+5 · Thunderbird+5

Chiaki Ishikawa · Published 2020-02-11 · Updated 2024-06-15 · CVE-2020-6793

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.5

Description The issue is related to Thunderbird's processing of email messages with ill-formed envelopes, which could lead to reading data from a random memory location. This is due to a buffer overflow in memory, allowing an attacker to potentially disclose protected information by sending a specially crafted email message.

Recommendations For versions prior to 68.5, update to version 68.5 or later to resolve the issue.

Exploit

Fix

Out of bounds Read

Use of Uninitialized Resource

Weakness Enumeration

CWE-125

CWE-908

Related Identifiers

ALT-PU-2020-1182

ALT-PU-2020-1515

BDU:2022-05807

CESA-2020_0574

CESA-2020_0576

CESA-2020_0577

CVE-2020-6793

DLA-2104-1

DSA-4625-1

MGASA-2020-0091

OPENSUSE-SU-2020:0231-1

OPENSUSE-SU-2020_0231-1

OPENSUSE-SU-2024:10601-1

RHSA-2020:0565

RHSA-2020:0574

RHSA-2020:0576

RHSA-2020:0577

RHSA-2020_0574

RHSA-2020_0576

RHSA-2020_0577

SUSE-SU-2020:0385-1

USN-4328-1

USN-4335-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Thunderbird

Ubuntu

References · 477

• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://ubuntu.com/security/CVE-2020-6795 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6792 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17017 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17024 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17012 · Vendor Advisory
• https://usn.ubuntu.com/4328-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6794 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4625-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11758 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-10 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-6806 · Vendor Advisory