CVE-2020-26959

{"containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "affected", "version": "< 83"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"status": "affected", "version": "< 78.5"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "affected", "version": "< 78.5"}]}], "descriptions": [{"lang": "en", "value": "During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5."}], "problemTypes": [{"descriptions": [{"description": "Use-after-free in WebRequestService", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-12-09T00:22:44.000Z", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1669466"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-50/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-52/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-51/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2020-26959", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Firefox", "version": {"version_data": [{"version_value": "< 83"}]}}, {"product_name": "Firefox ESR", "version": {"version_data": [{"version_value": "< 78.5"}]}}, {"product_name": "Thunderbird", "version": {"version_data": [{"version_value": "< 78.5"}]}}]}, "vendor_name": "Mozilla"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use-after-free in WebRequestService"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1669466", "refsource": "MISC", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1669466"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2020-50/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2020-50/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2020-52/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2020-52/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2020-51/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2020-51/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T16:03:23.168Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1669466"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-50/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-52/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-51/"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2020-26959", "datePublished": "2020-12-09T00:22:44.000Z", "dateReserved": "2020-10-12T00:00:00.000Z", "dateUpdated": "2024-08-04T16:03:23.168Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"status": "affected", "version": "< 83"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"status": "affected", "version": "< 78.5"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "affected", "version": "< 78.5"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "9385C808-43DD-4D02-B1A9-89A2E3986DF2", "versionEndExcluding": "83.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "36160ED9-05B8-4E38-8C67-49EE1738AF8B", "versionEndExcluding": "78.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "C169EC17-3490-437D-A36B-40C3DE316175", "versionEndExcluding": "78.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5."}, {"lang": "es", "value": "Durante el cierre del navegador, la disminuci\u00f3n de la referencia podr\u00eda haber ocurrido en un objeto previamente liberado, resultando en un uso de la memoria previamente liberada, una corrupci\u00f3n de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 83, Firefox ESR versiones anteriores a 78.5, y Thunderbird versiones anteriores a 78.5"}], "id": "CVE-2020-26959", "lastModified": "2026-06-17T03:08:37.300", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-09T01:15:13.143", "references": [{"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1669466"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-50/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-51/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-52/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1669466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-50/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-51/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2020-52/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Bharadwaj Machiraju as the original reporter.", "affected_release": [{"advisory": "RHSA-2020:5238", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "thunderbird-0:78.5.0-1.el6_10", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5257", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "firefox-0:78.5.0-1.el6_10", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5235", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:78.5.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5239", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:78.5.0-1.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5236", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:78.5.0-1.el8_3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5237", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:78.5.0-1.el8_3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5240", "cpe": "cpe:/a:redhat:rhel_e4s:8.0", "package": "thunderbird-0:78.5.0-1.el8_0", "product_name": "Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5314", "cpe": "cpe:/a:redhat:rhel_e4s:8.0", "package": "firefox-0:78.5.0-1.el8_0", "product_name": "Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions", "release_date": "2020-12-01T00:00:00Z"}, {"advisory": "RHSA-2020:5231", "cpe": "cpe:/a:redhat:rhel_eus:8.1", "package": "thunderbird-0:78.5.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5233", "cpe": "cpe:/a:redhat:rhel_eus:8.1", "package": "firefox-0:78.5.0-1.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5232", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "thunderbird-0:78.5.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2020-11-30T00:00:00Z"}, {"advisory": "RHSA-2020:5234", "cpe": "cpe:/a:redhat:rhel_eus:8.2", "package": "firefox-0:78.5.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2020-11-30T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Use-after-free in WebRequestService", "id": "1898736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1898736"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["During browser shutdown, reference decrementing could have occured on a previously freed object, resulting in a use-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5."], "name": "CVE-2020-26959", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2020-11-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-26959\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-26959\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2020-51/#CVE-2020-26959"], "threat_severity": "Moderate"}

{}