PT-2019-19873 · Mozilla+3 · Firefox Esr+5
Daniel Veditz
·
Publicado
2019-03-19
·
Atualizado
2024-12-12
·
CVE-2019-9801
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 66
Firefox ESR versions prior to 60.6
Thunderbird versions prior to 60.6
Description
The issue affects Firefox on Windows operating systems, where it accepts any registered Program ID as an external protocol handler, offering to launch local applications when given a matching URL. This should only occur if the program has registered itself as a "URL Handler" in the Windows registry. The issue is specific to Windows operating systems, with other operating systems being unaffected.
Recommendations
For Firefox versions prior to 66, update to version 66 or later to resolve the issue.
For Firefox ESR versions prior to 60.6, update to version 60.6 or later to resolve the issue.
For Thunderbird versions prior to 60.6, update to version 60.6 or later to resolve the issue.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Firefox Esr
Suse
Thunderbird
Windows