The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
References
| Link | Resource |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2019-38/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2019-37/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 | Exploit Issue Tracking Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2019-36/ | Vendor Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html | Issue Tracking Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html | Issue Tracking Third Party Advisory |
| https://usn.ubuntu.com/4241-1/ | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2020:0295 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2020:0292 | Third Party Advisory |
| https://security.gentoo.org/glsa/202003-02 | Third Party Advisory |
| https://security.gentoo.org/glsa/202003-10 | Third Party Advisory |
| https://usn.ubuntu.com/4335-1/ | Third Party Advisory |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Information
Published : 2020-01-08 14:15
Updated : 2022-04-08 07:31
NVD link : CVE-2019-17005
Mitre link : CVE-2019-17005
JSON object : View
CWE
CWE-787
Out-of-bounds Write
Advertisement
Products Affected
mozilla
- firefox_esr
- thunderbird
- firefox
canonical
- ubuntu_linux
opensuse
- leap