Description
When aborting an operation, such as a fetch, an abort signal may be deleted while alerting the objects to be notified. This results in a use-after-free and we presume that with enough effort it could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.12 and Thunderbird < 68.12.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mozilla | Firefox ESR | unspecified – < 68.12 | 68.12 |
| Mozilla | Thunderbird | unspecified – < 68.12 | 68.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 68.12.0esr-1 | — |
| Debian 14 | thunderbird | 1:68.12.0-1 | — |
| Debian 13 | firefox-esr | 68.12.0esr-1 | — |
| Debian 13 | thunderbird | 1:68.12.0-1 | — |
| Debian 12 | firefox-esr | 68.12.0esr-1 | — |
| Debian 12 | thunderbird | 1:68.12.0-1 | — |
| Debian 10 | firefox-esr | 68.12.0esr-1~deb10u1 | DSA-4749-1 |
| Debian 10 | thunderbird | 1:68.12.0-1~deb10u1 | DSA-4754-1 |
| Debian 9 | firefox-esr | 68.12.0esr-1~deb9u1 | DLA-2346-1 |
| Debian 9 | thunderbird | 1:68.12.0-1~deb9u1 | DLA-2360-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | thunderbird | 1:78.8.1+build1-0ubuntu0.18.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | firefox | 78.2.0-2.el8_2 | RHSA-2020:3557 |
| RHEL 8 | thunderbird | 68.12.0-1.el8_2 | RHSA-2020:3634 |
| RHEL 7 | firefox +1 | 68.12.0-1.el7_8 | RHSA-2020:3631, RHSA-2020:3556 |
| RHEL 6 | firefox +1 | 68.12.0-1.el6_10 | RHSA-2020:3643, RHSA-2020:3558 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.1 EUS | firefox | 78.2.0-3.el8_1 | RHSA-2020:3559 |
| RHEL 8.1 EUS | thunderbird | 68.12.0-1.el8_1 | RHSA-2020:3632 |
| RHEL 8.0 E4S | firefox | 78.2.0-3.el8_0 | RHSA-2020:3555 |
| RHEL 8.0 E4S | thunderbird | 68.12.0-1.el8_0 | RHSA-2020:3633 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | MozillaThunderbird | 68.12.0-3.94.1 | SUSE-SU-2020:2552-1 |
| SLES 15 SP1 | MozillaThunderbird | 68.12.0-3.94.1 | SUSE-SU-2020:2552-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaThunderbird | 91.1.1-1.1 | openSUSE-SU-2024:10601-1 |
| openSUSE Leap 15.2 | MozillaThunderbird | 68.12.0-lp152.2.10.1 | openSUSE-SU-2020:1392-1 |
| openSUSE Leap 15.1 | MozillaThunderbird | 68.12.0-lp151.2.50.1 | openSUSE-SU-2020:1383-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | thunderbird | 68.12.0-1.amzn2 | ALAS2-2020-1496 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | firefox | 78.2.0-2.0.1.el8_2 | ELSA-2020-3557 |
| Oracle Linux 8 | thunderbird | 68.12.0-1.0.1.el8_2 | ELSA-2020-3634 |
| Oracle Linux 7 | firefox | 68.12.0-1.0.3.el7_8 | ELSA-2020-3556 |
| Oracle Linux 7 | thunderbird | 68.12.0-1.0.1.el7_8 | ELSA-2020-3631 |
Advisories 23
- RHSA-2020:3631 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:3643 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:3558 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:3556 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-4754-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4749-1 firefox-esr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2346-1 firefox-esr - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2360-1 thunderbird - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:2552-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1383-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1392-1 Security update for MozillaThunderbird SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2020:3557 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jan 28, 2026
- RHSA-2020:3559 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2020:3555 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2020:3634 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:3633 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:3632 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2024:10601-1 MozillaThunderbird-91.1.1-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2-2020-1496 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 30, 2020
- ELSA-2020-3631 Important: thunderbird security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 17, 2020
- ELSA-2020-3634 Important: thunderbird security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 8, 2020
- ELSA-2020-3556 Important: firefox security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 8, 2020
- ELSA-2020-3557 Important: firefox security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 28, 2020