Mozilla · Firefox and Thunderbird
CVE-2020-6819
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
Cos'è
Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and Firefox ESR < 68.6.1.
CISA: Mozilla Firefox and Thunderbird contain a race condition vulnerability when running the nsDocShell destructor under certain conditions. The race condition creates a use-after-free vulnerability, causing unspecified impacts.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 3 maggio 2022
Altre falle sfruttate di Mozilla
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 23 mag 2022 | Type Confusion | Firefox and Thunderbird | Alta 8,8 | 38% |
| 23 mag 2022 | Sandbox Escape | Firefox and Thunderbird | Critica 10,0 | 56% |
| 28 mar 2022 | Denial-of-Service | Firefox and Thunderbird | Alta 8,8 | 69% |
| 3 nov 2021 | Use-After-Free | Firefox and Thunderbird | Alta 8,1 | 7,1% |
| 3 nov 2021 | Type Confusion | Firefox and Thunderbird | Alta 8,8 | 46% |
| 6 ott 2025 | Remote Code Execution | Multiple Products | Critica 9,8 | 83% |
| 15 ott 2024 | Use-After-Free | Firefox | Critica 9,8 | 23% |
| 22 giu 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | Alta 7,5 | 87% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.