PT-2019-6252 · Mozilla+2 · Firefox Esr+4

Robert Strong · Published 2019-12-03 · Updated 2020-08-24 · CVE-2019-17009

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 71 Mozilla Firefox ESR versions prior to 68.3 Thunderbird versions prior to 68.3

Description The issue is related to errors in handling temporary files by the update service of Mozilla Firefox, Mozilla Firefox ESR, and the Thunderbird email client for Windows. Exploitation of this issue could allow an attacker to write status and log files to an unprotected directory. This requires local system access and only affects Windows, with other operating systems not being affected.

Recommendations For Mozilla Firefox versions prior to 71, update to version 71 or later. For Mozilla Firefox ESR versions prior to 68.3, update to version 68.3 or later. For Thunderbird versions prior to 68.3, update to version 68.3 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-377

CWE-276

Related Identifiers

ALT-PU-2019-3237

ALT-PU-2019-3239

ALT-PU-2019-3264

ALT-PU-2020-1166

ALT-PU-2020-1515

ALT-PU-2020-1617

BDU:2022-05929

CVE-2019-17009

MGASA-2019-0376

MGASA-2019-0377

OPENSUSE-SU-2020:0002-1

OPENSUSE-SU-2020:0003-1

OPENSUSE-SU-2020_0002-1

SUSE-SU-2019:14260-1

SUSE-SU-2019:3337-1

SUSE-SU-2019:3339-1

SUSE-SU-2019:3347-1

SUSE-SU-2019_14260-1

Affected Products

Alt Linux

Firefox

Firefox Esr

Suse

Thunderbird

References · 55

• https://ubuntu.com/security/CVE-2019-17009 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14260-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3339-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05929 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2020:0003-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0377 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17009 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:0002-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-37/#CVE-2019-17009 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:3337-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17009 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:3347-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0377.html · Security Note