PT-2019-6252 · Mozilla+2 · Firefox Esr+4

Robert Strong · Publicado 2019-12-03 · Atualizado 2020-08-24 · CVE-2019-17009

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 71 Mozilla Firefox ESR versions prior to 68.3 Thunderbird versions prior to 68.3

Description The issue is related to errors in handling temporary files by the update service of Mozilla Firefox, Mozilla Firefox ESR, and the Thunderbird email client for Windows. Exploitation of this issue could allow an attacker to write status and log files to an unprotected directory. This requires local system access and only affects Windows, with other operating systems not being affected.

Recommendations For Mozilla Firefox versions prior to 71, update to version 71 or later. For Mozilla Firefox ESR versions prior to 68.3, update to version 68.3 or later. For Thunderbird versions prior to 68.3, update to version 68.3 or later.

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-377

CWE-276

Identificadores relacionados

ALT-PU-2019-3237

ALT-PU-2019-3239

ALT-PU-2019-3264

ALT-PU-2020-1166

ALT-PU-2020-1515

ALT-PU-2020-1617

BDU:2022-05929

CVE-2019-17009

MGASA-2019-0376

MGASA-2019-0377

OPENSUSE-SU-2020:0002-1

OPENSUSE-SU-2020:0003-1

OPENSUSE-SU-2020_0002-1

SUSE-SU-2019:14260-1

SUSE-SU-2019:3337-1

SUSE-SU-2019:3339-1

SUSE-SU-2019:3347-1

SUSE-SU-2019_14260-1

Produtos afetados

Alt Linux

Firefox

Firefox Esr

Suse

Thunderbird

Referências · 55

• https://suse.com/security/cve/CVE-2019-17009 · Nota
• https://ubuntu.com/security/CVE-2019-17009 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2019-17009 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2019:14260-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:3339-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-05929 · Nota de Segurança
• https://lists.opensuse.org/archives/list/[e-mail]/thread/NRHDWT3QC423VY6ACEY346YD3PPCAECZ · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20193337-1 · Nota
• https://thunderbird.net/en-US/thunderbird/68.3.0/releasenotes · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2020:0003-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2019/suse-su-20193347-1 · Nota
• https://altsp.su/obnovleniya-bezopasnosti · Nota
• https://osv.dev/vulnerability/MGASA-2019-0377 · Aviso do Fabricante
• https://mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17009 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2020:0002-1 · Aviso do Fabricante