PT-2019-5128 · Mozilla+5 · Firefox+5

J.C. Jones · Published 2019-12-03 · Updated 2024-12-12 · CVE-2019-11756

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 71

Description The issue is related to improper refcounting of soft token session objects, which could cause a use-after-free and crash, likely limited to a denial of service. It may also allow a remote attacker to gain unauthorized access to confidential data, cause a denial of service, and impact data integrity.

Recommendations For versions prior to 71, update to version 71 or later to resolve the issue.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2019-3239

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

BDU:2020-01795

CESA-2020_3280

CESA-2020_4076

CVE-2019-11756

OESA-2021-1059

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2020:3280

RHSA-2020:4076

RHSA-2020_3280

RHSA-2020_4076

RHSA-2021:0758

RHSA-2021:0876

RHSA-2021:1026

RLSA-2020:3280

USN-4216-1

USN-4216-2

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Rocky Linux

Ubuntu

References · 1920

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_jit_use_after_free.rb · Exploit
• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2019-11756 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17007 · Security Note
• https://ubuntu.com/security/CVE-2019-17012 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-36 · Vendor Advisory