Out-of-bounds Write Affecting thunderbird package, versions <78.6.1-r0


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.61% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE319-THUNDERBIRD-6111851
  • published8 Dec 2023
  • disclosed7 Jan 2021

Introduced: 7 Jan 2021

CVE-2020-26974  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade Alpine:3.19 thunderbird to version 78.6.1-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream thunderbird package and not the thunderbird package as distributed by Alpine. See How to fix? for Alpine:3.19 relevant fixed versions and status.

When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.

CVSS Scores

version 3.1