CVE-2020-6831: A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC

Description

A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)5.8% · higher than 93% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FI

Firefox · Mozilla

before 76.0 · source: NVD

DL

Debian Linux · Debian

9.0; 10.0 · source: NVD

FE

Firefox Esr · Mozilla

before 68.8.0 · source: NVD

LE

Leap · Opensuse

15.2 · source: NVD

TH

Thunderbird · Mozilla

before 68.8.0 · source: NVD

UL

Ubuntu Linux · Canonical

16.04; 18.04; 19.10; 20.04 · source: NVD