CVE-2020-26974
Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
Cuando flex-basis fue usada en un contenedor de tabla, un objeto StyleGenericFlexBasis podría haberse convertido incorrectamente en el tipo equivocado. Esto resultó en uso de la memoria previamente liberada de la pila, una corrupción de la memoria y un bloqueo potencialmente explotable. Esta vulnerabilidad afecta a Firefox versiones anteriores a 84, Thunderbird versiones anteriores a 78,6 y Firefox ESR versiones anteriores a 78,6
The Mozilla Foundation Security Advisory describes this flaw as:
When `flex-basis` was used on a table wrapper, a `StyleGenericFlexBasis` object could have been incorrectly cast to the wrong type. This resulted in a heap user-after-free, memory corruption, and a potentially exploitable crash.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-10-12 CVE Reserved
- 2020-12-16 CVE Published
- 2024-08-04 CVE Updated
- 2024-11-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-416: Use After Free
- CWE-787: Out-of-bounds Write
CAPEC
References (5)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.mozilla.org/security/advisories/mfsa2020-54 | 2021-01-12 | |
| https://www.mozilla.org/security/advisories/mfsa2020-55 | 2021-01-12 | |
| https://www.mozilla.org/security/advisories/mfsa2020-56 | 2021-01-12 | |
| https://access.redhat.com/security/cve/CVE-2020-26974 | 2020-12-21 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1908024 | 2020-12-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 84.0 Search vendor "Mozilla" for product "Firefox" and version " < 84.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 78.6.0 Search vendor "Mozilla" for product "Firefox Esr" and version " < 78.6.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 78.6.0 Search vendor "Mozilla" for product "Thunderbird" and version " < 78.6.0" | - |
Affected
| ||||||