Mozilla developers and community members reported memory safety bugs present in Firefox 72 and Firefox ESR 68.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. In general, these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts. This vulnerability affects Thunderbird < 68.5, Firefox < 73, and Firefox < ESR68.5.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefox-esralpine-linux-upgrade-thunderbirdalpine-linux-upgrade-firefox | Mar 24, 2020 | Mar 2, 2020 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Apr 27, 2020 | Mar 2, 2020 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 2, 2020 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsourcecentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | Feb 18, 2020 | Feb 17, 2020 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | Feb 18, 2020 | Feb 18, 2020 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Mar 13, 2020 | Mar 2, 2020 | |
| Mfsa2020 05 | mozilla-firefox-upgrade-73_0 | Feb 12, 2020 | Feb 11, 2020 | |
| Mfsa2020 06 | mozilla-firefox-esr-upgrade-68_5 | Mar 11, 2020 | Mar 2, 2020 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-68_5 | Feb 12, 2020 | Feb 11, 2020 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-68-5-0-11-4-19-0-1-2-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-68-5-0-11-4-19-0-1-2-0oracle-solaris-11-4-upgrade-web-browser-firefox-68-5-0-11-4-19-0-1-2-0oracle-solaris-11-4-upgrade-web-data-firefox-bookmarks-68-5-0-11-4-19-0-1-2-0 | Jan 19, 2021 | Mar 2, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Mar 2, 2020 | Feb 11, 2020 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | Feb 18, 2020 | Feb 17, 2020 | |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Feb 18, 2020 | Feb 13, 2020 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Feb 14, 2020 | Feb 13, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub