CVE-2019-17010
Mozilla: Use-after-free when performing device orientation checks
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
Bajo determinadas condiciones, cuando se comprueba la preferencia Resist Fingerprinting durante las verificaciones de orientación del dispositivo, una condición de carrera podría haber causado un uso de la memoria previamente liberada y un bloqueo explotable potencialmente. Esta vulnerabilidad afecta a Thunderbird versiones anteriores a la versión 68.3, Firefox ESR versiones anteriores a la versión 68.3 y Firefox versiones anteriores a la versión 71.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-09-30 CVE Reserved
- 2019-12-04 CVE Published
- 2024-05-03 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-416: Use After Free
CAPEC
References (14)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 | 2024-08-05 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html | 2022-04-08 | |
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html | 2022-04-08 | |
https://access.redhat.com/errata/RHSA-2020:0292 | 2022-04-08 | |
https://access.redhat.com/errata/RHSA-2020:0295 | 2022-04-08 | |
https://security.gentoo.org/glsa/202003-02 | 2022-04-08 | |
https://security.gentoo.org/glsa/202003-10 | 2022-04-08 | |
https://usn.ubuntu.com/4241-1 | 2022-04-08 | |
https://usn.ubuntu.com/4335-1 | 2022-04-08 | |
https://www.mozilla.org/security/advisories/mfsa2019-36 | 2022-04-08 | |
https://www.mozilla.org/security/advisories/mfsa2019-37 | 2022-04-08 | |
https://www.mozilla.org/security/advisories/mfsa2019-38 | 2022-04-08 | |
https://access.redhat.com/security/cve/CVE-2019-17010 | 2020-01-30 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1779434 | 2020-01-30 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 71.0 Search vendor "Mozilla" for product "Firefox" and version " < 71.0" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 68.3 Search vendor "Mozilla" for product "Firefox Esr" and version " < 68.3" | - |
Affected
| ||||||
Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 68.3 Search vendor "Mozilla" for product "Thunderbird" and version " < 68.3" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | esm |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 19.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "19.10" | - |
Affected
|