CVEvulnerability
CVE-2019-17024
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-01-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-787
Description
Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
Affected configurations
• mozilla firefox (< 72.0)
• mozilla firefox esr (< 68.4)
• canonical ubuntu linux 16.04
• canonical ubuntu linux 18.04
• canonical ubuntu linux 19.04
• canonical ubuntu linux 19.10
• debian debian linux 8.0
• debian debian linux 9.0
• debian debian linux 10.0
• redhat enterprise linux 8.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux eus 7.7
• redhat enterprise linux eus 8.1
• redhat enterprise linux eus 8.2
• redhat enterprise linux eus 8.4
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.7
• redhat enterprise linux server aus 8.2
• redhat enterprise linux server aus 8.4
• redhat enterprise linux server tus 7.7
• redhat enterprise linux server tus 8.2
• redhat enterprise linux server tus 8.4
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• opensuse leap 15.1
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html Exploit, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2020:0085 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0086 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0111 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0120 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0123 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0127 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0292 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0295 Third Party Advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826 Issue Tracking, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/12 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/18 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/26 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202003-02 Third Party Advisory
- https://usn.ubuntu.com/4234-1/ Third Party Advisory
- https://usn.ubuntu.com/4241-1/ Third Party Advisory
- https://usn.ubuntu.com/4335-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4600 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4603 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-01/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-02/ Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html Mailing List, Third Party Advisory
- http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html Exploit, Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2020:0085 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0086 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0111 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0120 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0123 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0127 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0292 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0295 Third Party Advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605%2C1601826 Issue Tracking, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html Mailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/12 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/18 Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2020/Jan/26 Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202003-02 Third Party Advisory
- https://usn.ubuntu.com/4234-1/ Third Party Advisory
- https://usn.ubuntu.com/4241-1/ Third Party Advisory
- https://usn.ubuntu.com/4335-1/ Third Party Advisory
- https://www.debian.org/security/2020/dsa-4600 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4603 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-01/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-02/ Vendor Advisory