CVEvulnerability
CVE-2019-9802
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-04-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-125
Description
If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process, which may include sensitive data. This vulnerability affects Firefox < 66.
Affected configurations
• mozilla firefox (< 66.0)
Related
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1415508 Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-07/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1415508 Issue Tracking, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-07/ Vendor Advisory