high8.8
CVE-2020-26973
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed.
Impact
Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass. This vulnerability affects Firefox < 84, Thunderbird < 78.6, and Firefox ESR < 78.6.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 84.0 |
| Mozilla | Firefox Esr | before 78.6.0 |
| Mozilla | Thunderbird | before 78.6.0 |
References
- NVD record
- CVE.org record
- https://bugzilla.mozilla.org/show_bug.cgi?id=1680084
- https://www.mozilla.org/security/advisories/mfsa2020-54/
- https://www.mozilla.org/security/advisories/mfsa2020-55/
- https://www.mozilla.org/security/advisories/mfsa2020-56/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1680084
- https://www.mozilla.org/security/advisories/mfsa2020-54/
- https://www.mozilla.org/security/advisories/mfsa2020-55/
- https://www.mozilla.org/security/advisories/mfsa2020-56/