CVE-2020-6822

On 32-bit builds, an out of bounds write could have occurred when processing an image larger than 4 GB in <code>GMPDecodeData</code>. It is possible that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 68.7.0, Firefox ESR < 68.7, and Firefox < 75.

• CWE-787

• https://bugzilla.mozilla.org/show_bug.cgi?id=1544181Issue Tracking, Permissions Required
• https://usn.ubuntu.com/4335-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-12/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-13/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-14/Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1544181Issue Tracking, Permissions Required
• https://usn.ubuntu.com/4335-1/Third Party Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-12/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-13/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2020-14/Vendor Advisory

Published

Apr 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-6815Mozilla developers reported memory safety and script safety …9.8
• CVE-2020-6816In Mozilla Bleach before 3.12, a mutation XSS in bleach.clea…6.1
• CVE-2020-6817bleach.clean behavior parsing style attributes could result …7.5
• CVE-2020-6819Under certain conditions, when running the nsDocShell destru…8.1
• CVE-2020-6820Under certain conditions, when handling a ReadableStream, a …8.1
• CVE-2020-6821When reading from areas partially or fully outside the sourc…7.5
• CVE-2020-6823A malicious extension could have called <code>browser.identi…9.8
• CVE-2020-6824Initially, a user opens a Private Browsing Window and genera…2.8
• CVE-2020-6825Mozilla developers and community members Tyson Smith and Chr…9.8
• CVE-2020-6826Mozilla developers Tyson Smith, Bob Clary, and Alexandru Mic…9.8
• CVE-2020-6827When following a link that opened an intent://-schemed URL, …4.7
• CVE-2020-6828A malicious Android application could craft an Intent that w…7.5