Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
References
| Link | Resource |
|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 | Exploit Issue Tracking Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2019-38/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2019-37/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2019-36/ | Vendor Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html | Mailing List Third Party Advisory |
| https://usn.ubuntu.com/4241-1/ | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2020:0295 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2020:0292 | Third Party Advisory |
| https://security.gentoo.org/glsa/202003-02 | Third Party Advisory |
| https://security.gentoo.org/glsa/202003-10 | Third Party Advisory |
| https://usn.ubuntu.com/4335-1/ | Third Party Advisory |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Information
Published : 2020-01-08 14:15
Updated : 2022-04-08 07:32
NVD link : CVE-2019-17011
Mitre link : CVE-2019-17011
JSON object : View
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Advertisement
Products Affected
mozilla
- firefox_esr
- thunderbird
- firefox
canonical
- ubuntu_linux
opensuse
- leap