CVE-2020-26970

Cuando se leen los códigos de estado del servidor SMTP, Thunderbird escribe un valor entero hacia una posición en la pila que debe contener solo un byte. Dependiendo de la arquitectura del procesador y el diseño de la pila, esto conlleva a una corrupción de la pila que puede ser explotable. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a 78.5.1

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass the CSS sanitizer, or execute arbitrary code. It was discovered that the proxy.onRequest API did not catch view-source URLs. If a user were tricked in to installing an extension with the proxy permission and opening View Source, an attacker could potentially exploit this to obtain sensitive information. Various other issues were also addressed.