PT-2019-6061 · Mozilla+2 · Firefox+2

Seb Patane · Published 2019-09-03 · Updated 2024-12-12 · CVE-2019-11736

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 69 Firefox ESR versions prior to 68.1

Description The issue is caused by errors in synchronization when using a shared resource in the Mozilla Maintenance Service of Firefox ESR and Firefox browsers. This can allow an attacker to elevate their privileges. Specifically, the Maintenance Service does not prevent files from being hardlinked to another file in the updates directory, which can lead to the replacement of local files, including the Maintenance Service executable that runs with privileged access. A race condition during checks for junctions and symbolic links can also allow for undetected local file and directory manipulation in some cases. This vulnerability requires local system access and only affects Windows.

Recommendations For Firefox versions prior to 69, update to version 69 or later to resolve the issue. For Firefox ESR versions prior to 68.1, update to version 68.1 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2019-2640

ALT-PU-2019-2644

ALT-PU-2019-2686

ALT-PU-2020-1617

BDU:2021-04379

CVE-2019-11736

MGASA-2019-0268

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:14246-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

Affected Products

Alt Linux

Firefox

Suse

References · 2099

• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0268 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04379 · Security Note
• https://mozilla.org/security/advisories/mfsa2019-25 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-25 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11736 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2019-24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11736 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-25/#CVE-2019-11736 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-26 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html · Vendor Advisory