PT-2019-5038 · Mozilla+5 · Firefox Esr+7

Nils · Published 2019-09-03 · Updated 2024-12-12 · CVE-2019-17010

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.3 Firefox ESR versions prior to 68.3 Firefox versions prior to 71

Description The issue is related to a race condition that could cause a use-after-free, potentially leading to a crash. This occurs when checking the Resist Fingerprinting preference during device orientation checks. The vulnerability may allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity.

Recommendations For Thunderbird versions prior to 68.3, update to version 68.3 or later. For Firefox ESR versions prior to 68.3, update to version 68.3 or later. For Firefox versions prior to 71, update to version 71 or later.

Exploit

Fix

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

ALT-PU-2019-3237

ALT-PU-2019-3239

ALT-PU-2019-3264

ALT-PU-2020-1166

ALT-PU-2020-1515

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

BDU:2020-01675

CESA-2019_4107

CESA-2019_4108

CESA-2019_4111

CESA-2019_4148

CESA-2019_4195

CESA-2019_4205

CVE-2019-17010

DLA-2029-1

DLA-2036-1

DSA-4580-1

DSA-4585-1

MGASA-2019-0376

MGASA-2019-0377

OPENSUSE-SU-2020:0002-1

OPENSUSE-SU-2020:0003-1

OPENSUSE-SU-2020_0002-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

RHSA-2019:4107

RHSA-2019:4108

RHSA-2019:4111

RHSA-2019:4148

RHSA-2019:4195

RHSA-2019:4205

RHSA-2019_4107

RHSA-2019_4108

RHSA-2019_4111

RHSA-2019_4148

RHSA-2019_4195

RHSA-2019_4205

RHSA-2020:0292

RHSA-2020:0295

SUSE-SU-2019:14260-1

SUSE-SU-2019:3337-1

SUSE-SU-2019:3339-1

SUSE-SU-2019:3347-1

SUSE-SU-2019_14260-1

USN-4216-1

USN-4216-2

USN-4241-1

USN-4335-1

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Red Hat

Suse

Thunderbird

Ubuntu

References · 2073

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 · Exploit
• https://ubuntu.com/security/CVE-2020-6821 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11761 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-37 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory