Vulnerability in Mozilla Firefox
CVE-2020-6820
Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0, Firefox < 74.0.1, and F…
EPSS: 0.031 (87.1th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Thunderbird — versions unspecified
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- www.mozilla.org/security/advisories/mfsa2020-14/ (x_refsource_MISC)
- www.mozilla.org/security/advisories/mfsa2020-11/ (x_refsource_MISC)
- bugzilla.mozilla.org/show_bug.cgi (x_refsource_MISC)
- USN-4335-1 (vendor-advisory, x_refsource_UBUNTU)
Frequently asked questions
- What is CVE-2020-6820?
- CVE-2020-6820 is a vulnerability in Mozilla Firefox. Published 2020-04-24.
- Is CVE-2020-6820 known to be exploited?
- Yes. CVE-2020-6820 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 2 public proof-of-concept repositories are indexed.