Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-12418: Firefox/Thunderbird may leak memory to malicious web page
CVE-2020-12418 · published 6 years ago
Summary
Older versions of Firefox ESR, regular Firefox, and Thunderbird can unintentionally reveal parts of the computer's memory when a malicious website runs specially crafted JavaScript. This could let an attacker see confidential information from the browser. Updating to the latest version of each product eliminates the risk.
What to do
- Update debian firefox-esr to version 68.10.0esr-1.
- Update debian thunderbird to version 1:68.10.0-1.
- Update mozilla firefox to version 78.0 or later.
- Update mozilla firefox_esr to version 68.10 or later.
- Update mozilla thunderbird to version 68.10.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 68.10.0esr-1 Fix: upgrade to 68.10.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 68.10.0esr-1 Fix: upgrade to 68.10.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 68.10.0esr-1 Fix: upgrade to 68.10.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:68.10.0-1 Fix: upgrade to 1:68.10.0-1
|
| Debian:13 | debian | thunderbird |
< 1:68.10.0-1 Fix: upgrade to 1:68.10.0-1
|
| Debian:14 | debian | thunderbird |
< 1:68.10.0-1 Fix: upgrade to 1:68.10.0-1
|
| – | mozilla | firefox |
< 78.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 68.10 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 68.10.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
16.04 18.04 19.10 20.04 cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* |
| – | opensuse | leap |
15.1 15.2 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
Original advisory text
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, ...
Manipulating individual parts of a URL object could have caused an out-of-bounds read, leaking process memory to malicious JavaScript. This vulnerability affects Firefox ESR < 68.10, Firefox < 78, and Thunderbird < 68.10.0.
References
- https://security-tracker.debian.org/tracker/CVE-2020-12418 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00023.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00026.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00027.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00049.html Mailing List Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1641303 Issue Tracking Permissions Required Vendor Advisory
- https://security.gentoo.org/glsa/202007-09 Third Party Advisory
- https://security.gentoo.org/glsa/202007-10 Third Party Advisory
- https://usn.ubuntu.com/4421-1/ Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-24/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-25/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-26/ Vendor Advisory
Severity
6.5
Medium
Type
CWE-125Out-of-bounds Read
Timeline
Published9 Jul 2020
Updated31 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta