CentOS 6 update for thunderbird
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2020-6819 CVE-2020-6820 CVE-2020-6821 CVE-2020-6822 CVE-2020-6825 |
| CWE-ID | CWE-416 CWE-125 CWE-787 CWE-119 |
| Exploitation vector | Network |
| Public exploit |
Vulnerability #1 is being exploited in the wild. Vulnerability #2 is being exploited in the wild. |
| Vulnerable software Subscribe |
CentOS Operating systems & Components / Operating system |
| Vendor | CentOS Project |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Use-after-free
EUVDB-ID: #VU26573
Risk: Critical
CVSSv3.1:
CVE-ID: CVE-2020-6819
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error caused by a race condition running the nsDocShell destructor. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note, this vulnerability is being actively exploited in the wild in targeted attacks.
Update the affected packages.
Vulnerable software versionsCentOS: 6
CPE2.3 External linkshttp://lists.centos.org/pipermail/centos-announce/2020-April/035698.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
2) Use-after-free
EUVDB-ID: #VU26574
Risk: Critical
CVSSv3.1:
CVE-ID: CVE-2020-6820
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error caused by a race condition handling ReadableStream. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note, this vulnerability is being actively exploited in the wild in targeted attacks.
Update the affected packages.
Vulnerable software versionsCentOS: 6
CPE2.3 External linkshttp://lists.centos.org/pipermail/centos-announce/2020-April/035698.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
3) Out-of-bounds read
EUVDB-ID: #VU26649
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-6821
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when using WebGL copyTexSubImage method. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read contents of uninitialized memory on the system.
Update the affected packages.
Vulnerable software versionsCentOS: 6
CPE2.3 External linkshttp://lists.centos.org/pipermail/centos-announce/2020-April/035698.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
4) Out-of-bounds write
EUVDB-ID: #VU26650
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-6822
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary condition in GMPDecodeData when processing images larger than 4Gb on 32-bit builds. A remote attacker can create a specially crafted image, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.
Update the affected packages.
Vulnerable software versionsCentOS: 6
CPE2.3 External linkshttp://lists.centos.org/pipermail/centos-announce/2020-April/035698.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
5) Buffer overflow
EUVDB-ID: #VU26653
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-6825
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected packages.
Vulnerable software versionsCentOS: 6
CPE2.3 External linkshttp://lists.centos.org/pipermail/centos-announce/2020-April/035698.html
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
