PT-2020-6724 · Mozilla+1 · Firefox+1

Prithwish Kumar Pal · Published 2020-01-07 · Updated 2021-07-21 · CVE-2019-17019

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 72

Description The issue is related to the handling of Python files served with the MIME type of text/plain. When such a file is downloaded and the Open option is selected, it could be executed by Python instead of being opened as a text file. This problem only occurs on Windows, and other operating systems are not affected. The vulnerability may allow a remote attacker to execute arbitrary code due to errors in input processing.

Recommendations For versions prior to 72, update to version 72 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Open option when downloading Python files to prevent potential execution by Python. Restrict access to Python files served with the MIME type of text/plain to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-807

Related Identifiers

ALT-PU-2020-1110

ALT-PU-2020-1617

BDU:2022-05800

CVE-2019-17019

Affected Products

Alt Linux

Firefox

References · 14

• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• https://bdu.fstec.ru/vul/2022-05800 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17019 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17019 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17019 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17019 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-17019 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2020-01 · Vendor Advisory
• https://altsp.su/obnovleniya-bezopasnosti · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1568003 · Note