Vulnerabilities > Mozilla > Thunderbird > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-08-10 | CVE-2020-15656 | Type Confusion vulnerability in multiple products JIT optimizations involving the Javascript arguments object could confuse later optimizations. | 8.8 |
| 2020-07-09 | CVE-2020-12420 | Use After Free vulnerability in multiple products When trying to connect to a STUN server, a race condition could have caused a use-after-free of a pointer, leading to memory corruption and a potentially exploitable crash. | 8.8 |
| 2020-07-09 | CVE-2020-12419 | Use After Free vulnerability in multiple products When processing callbacks that occurred during window flushing in the parent process, the associated window may die; causing a use-after-free condition. | 8.8 |
| 2020-07-09 | CVE-2020-12417 | Incorrect Conversion between Numeric Types vulnerability in multiple products Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash. | 8.8 |
| 2020-07-09 | CVE-2020-12406 | Insufficient Verification of Data Authenticity vulnerability in multiple products Mozilla Developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting in a crash. | 8.8 |
| 2020-07-09 | CVE-2020-12398 | Cleartext Transmission of Sensitive Information vulnerability in multiple products If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response, then Thunderbird will continue with an unencrypted connection, causing email data to be sent without protection. | 7.5 |
| 2020-07-09 | CVE-2018-12371 | Integer Overflow or Wraparound vulnerability in Mozilla Firefox An integer overflow vulnerability in the Skia library when allocating memory for edge builders on some systems with at least 16 GB of RAM. | 8.8 |
| 2020-05-26 | CVE-2020-12387 | Use After Free vulnerability in Mozilla Thunderbird A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. | 8.1 |
| 2020-05-26 | CVE-2020-12393 | OS Command Injection vulnerability in Mozilla Firefox The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. | 7.8 |
| 2020-04-24 | CVE-2020-6822 | Out-of-bounds Write vulnerability in Mozilla Firefox On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. | 8.8 |