PT-2020-6712 · Mozilla+3 · Firefox+4

Thomas Imbert · Published 2020-01-07 · Updated 2024-06-15 · CVE-2019-17015

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 68.4 Firefox versions prior to 72

Description The issue is related to a memory corruption problem that can occur during the initialization of a new content process, potentially leading to a crash in the parent process. This problem is specific to Windows and does not affect other operating systems. The vulnerability is also described as a buffer overflow issue that could allow a remote attacker to execute arbitrary code.

Recommendations For Firefox ESR versions prior to 68.4, update to version 68.4 or later. For Firefox versions prior to 72, update to version 72 or later.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-1013

ALT-PU-2020-1032

ALT-PU-2020-1110

ALT-PU-2020-1166

ALT-PU-2020-1515

ALT-PU-2020-1617

BDU:2022-05733

CVE-2019-17015

OPENSUSE-SU-2020:0060-1

OPENSUSE-SU-2020:0094-1

OPENSUSE-SU-2020_0060-1

OPENSUSE-SU-2020_0094-1

OPENSUSE-SU-2024:10601-1

SUSE-SU-2020:0068-1

SUSE-SU-2020:0078-1

SUSE-SU-2020:0142-1

SUSE-SU-2020:14268-1

Affected Products

Alt Linux

Firefox

Firefox Esr

Suse

Windows

References · 439

• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://osv.dev/vulnerability/openSUSE-SU-2020:0094-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17015 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17015 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-01 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2020-04 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17015 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-17015 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2020-01 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:0142-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17015 · Vendor Advisory