Every CVE Search/ Get API key

CVE-2020-26966

Searching for a single word from the address bar caused an mDNS request to be sent on the local...

6.5 MediumFix available

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.35%Down 9.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Record
CVE-2020-26966
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE List No score

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Record
CVE-2020-26966
Updated
2026-11-02
EUVDEUVD-2020-19490 No score

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Record
EUVD-2020-19490
Updated
2026-11-03
GitHub AdvisoriesGHSA-c627-2gcf-x56f No score

Searching for a single word from the address bar caused an mDNS request to be sent on the local...

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Record
GHSA-c627-2gcf-x56f
Updated
2026-11-02
OSVALPINE-CVE-2020-26966 6.5

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Record
ALPINE-CVE-2020-26966
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-03
OSVUBUNTU-CVE-2020-26966 6.5

Searching for a single word from the address bar caused an mDNS request to be sent on the local network searching for a hostname consisting of that string; resulting in an information leak. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Firefox < 83, Firefox ESR < 78.5, and Thunderbird < 78.5.

Record
UBUNTU-CVE-2020-26966
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 13 moreShow less
OSVopenSUSE-SU-2020:2020-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2020-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2031-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2031-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2096-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2096-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2187-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2187-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:2315-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:2315-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10600-1 No score

MozillaFirefox-92.0-1.2 on GA media

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10600-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10601-1 No score

MozillaThunderbird-91.1.1-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10601-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2020:14548-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:14548-1
Updated
2026-11-02
OSVSUSE-SU-2020:3383-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:3383-1
Updated
2026-11-02
OSVSUSE-SU-2020:3458-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:3458-1
Updated
2026-11-02
OSVSUSE-SU-2020:3528-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

TODO

  • Mozilla Thunderbird 78.5.0

    • new: OpenPGP: Added option to disable attaching the public key to a signed message (bmo#1654950)
    • new: MailExtensions: 'compose_attachments' context added to Menus API (bmo#1670822)
    • new: MailExtensions: Menus API now available on displayed messages (bmo#1670825)
    • changed: MailExtensions: browser.tabs.create will now wait for 'mail-delayed-startup-finished' event (bmo#1674407)
    • fixed: OpenPGP: Support for inline PGP messages improved (bmo#1672851)
    • fixed: OpenPGP: Message security dialog showed unverified keys as unavailable (bmo#1675285)
    • fixed: Chat: New chat contact menu item did not function (bmo#1663321)
    • fixed: Various theme and usability improvements (bmo#1673861)
    • fixed: Various security fixes MFSA 2020-52 (bsc#1178894)
    • CVE-2020-26951 (bmo#1667113) Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012 (bmo#1642028) Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953 (bmo#1656741) Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956 (bmo#1666300) XSS through paste (manual and clipboard API)
    • CVE-2020-26958 (bmo#1669355) Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959 (bmo#1669466) Use-after-free in WebRequestService
    • CVE-2020-26960 (bmo#1670358) Potential use-after-free in uses of nsTArray
    • CVE-2020-15999 (bmo#1672223) Heap buffer overflow in freetype
    • CVE-2020-26961 (bmo#1672528) DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965 (bmo#1661617) Software keyboards may have remembered typed passwords
    • CVE-2020-26966 (bmo#1663571) Single-word search queries were also broadcast to local network
    • CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697, bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479, bmo#1671923) Memory safety bugs fixed in Thunderbird 78.5

  • Mozilla Thunderbird 78.4.3

    • fixed: User interface was inconsistent when switching from the default theme to the dark theme and back to the default theme (bmo#1659282)
    • fixed: Email subject would disappear when hovering over it with the mouse when using Windows 7 Classic theme (bmo#1675970)
Record
SUSE-SU-2020:3528-1
Updated
2026-11-02
OSVSUSE-SU-2020:3548-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

  • Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
    • CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
    • CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
    • CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
    • CVE-2020-26956: XSS through paste (manual and clipboard API)
    • CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
    • CVE-2020-26959: Use-after-free in WebRequestService
    • CVE-2020-26960: Potential use-after-free in uses of nsTArray
    • CVE-2020-15999: Heap buffer overflow in freetype
    • CVE-2020-26961: DoH did not filter IPv4 mapped IP Addresses
    • CVE-2020-26965: Software keyboards may have remembered typed passwords
    • CVE-2020-26966: Single-word search queries were also broadcast to local network
    • CVE-2020-26968: Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5
Record
SUSE-SU-2020:3548-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox
Alpine:v3.12
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.13
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.14
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.15
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.16
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.17
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.18
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.19
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.20
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.21
 before 83.0-r0
83.0-r0
Show 61 moreShow less
Affected packages
PackageAffectedFixed
firefox
Alpine:v3.22
 before 83.0-r0
83.0-r0
firefox
Alpine:v3.23
 before 83.0-r0
83.0-r0
firefox-esr
Alpine:v3.12
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.13
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.14
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.15
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.16
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.17
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.18
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.19
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.20
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.21
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.22
 before 78.5.0-r0
78.5.0-r0
firefox-esr
Alpine:v3.23
 before 78.5.0-r0
78.5.0-r0
librewolf
Alpine:v3.21
 before 83.0-r0
83.0-r0
librewolf
Alpine:v3.22
 before 83.0-r0
83.0-r0
librewolf
Alpine:v3.23
 before 83.0-r0
83.0-r0
librewolf
Alpine:v3.24
 before 83.0-r0
83.0-r0
thunderbird
Alpine:v3.16
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.17
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.18
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.19
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.20
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.21
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.22
 before 78.5.1-r0
78.5.1-r0
thunderbird
Alpine:v3.23
 before 78.5.1-r0
78.5.1-r0
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-78.105.1
78.5.0-78.105.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 12 CVEs
 before 78.5.0-3.119.1
78.5.0-3.119.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP2
From an advisory covering 12 CVEs
 before 78.5.0-8.17.1
78.5.0-8.17.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 12 CVEs
 before 78.5.0-3.107.1
78.5.0-3.107.1
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP2
From an advisory covering 12 CVEs
 before 78.5.0-3.107.1
78.5.0-3.107.1
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud 9
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4-LTSS
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 12 CVEs
 before 78.5.0-112.36.1
78.5.0-112.36.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs68
Ubuntu:20.04:LTS
 All versions, plus listed versions
68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 78.5.0-lp152.2.30.1
78.5.0-lp152.2.30.1
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 78.5.0-lp151.2.79.1
78.5.0-lp151.2.79.1
MozillaThunderbird
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 78.5.0-lp152.2.19.1
78.5.0-lp152.2.19.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 78.5.0-lp151.2.59.1
78.5.0-lp151.2.59.1
MozillaFirefox
openSUSE:Leap 15.2
From an advisory covering 12 CVEs
 before 78.5.0-lp152.2.33.1
78.5.0-lp152.2.33.1
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 661 CVEs
 before 92.0-1.2
92.0-1.2
MozillaThunderbird
openSUSE:Tumbleweed
From an advisory covering 394 CVEs
 before 91.1.1-1.1
91.1.1-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-26966 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published November 19, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in firefox 83.0-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,772 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open