Multiple vulnerabilities in Mozilla Firefox

Published: 2019-10-23 | Updated: 2019-10-23
Severity High
Patch available YES
Number of vulnerabilities 13
CVE ID CVE-2019-17000
CVE-2019-11765
CVE-2019-11763
CVE-2019-11762
CVE-2019-11757
CVE-2019-15903
CVE-2019-11759
CVE-2019-11760
CVE-2019-11761
CVE-2018-6156
CVE-2019-17001
CVE-2019-17002
CVE-2019-11764
CWE ID CWE-264
CWE-693
CWE-416
CWE-125
CWE-121
CWE-122
CWE-319
CWE-119
Exploitation vector Network
Public exploit Public exploit code for vulnerability #6 is available.
Vulnerable software Mozilla Firefox Subscribe
Vendor Mozilla

Security Advisory

1) Permissions, Privileges, and Access Controls

Severity: Medium

CVSSv3: 5.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-17000

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the object tag with a data URI does not correctly inherit the document's Content Security Policy. A remote attacker can use a specually crafted website to bypass a cross-origin frame if the document's policy explicitly allowed data: URIs.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11765

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the way Firefox handles messages to the parent process that trigger the 'Click to Play' permission prompt to be shown. A remote attacker can create a specially crafted web page and assign arbitrary permissions instead of 'Click to Play' permission, if the user accepted the permission request.


Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Protection mechanism failure

Severity: Low

CVSSv3: 4.1 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11763

CWE-ID: CWE-693 - Protection Mechanism Failure

Description

The vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability exists due to the way Firefox processes HTML entities. A remote attacker can create a specially crafted web page and make the browser treat HTML comment text  as HTML, which could have led to XSS in a web application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Permissions, Privileges, and Access Controls

Severity: Low

CVSSv3: 3.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11762

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Firefox processes two same-origin documents that set document.domain differently to become cross-origin. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information, as it is possible to call arbitrary DOM methods/getters/setters on the now-cross-origin window.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11757

CWE-ID: CWE-416 - Use After Free

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when storing a value in IndexedDB. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

Severity: Medium

CVSSv3: 4.9 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-15903

CWE-ID: CWE-125 - Out-of-bounds Read

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing XML documents within the expat library. A remote attacker can create a specially crafted XML file, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the affected application.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://github.com/libexpat/libexpat/commit/c20b758c332d9a13afbbb276d30db1d183a85d43
https://github.com/libexpat/libexpat/issues/317
https://github.com/libexpat/libexpat/pull/318

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

7) Stack-based buffer overflow

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11759

CWE-ID: CWE-121 - Stack-based Buffer Overflow

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when  processing HMAC data. A remote attacker can create a specially crafted web page that causes 4 bytes of HMAC output to be written past the end of a buffer stored on the stack, trick the victim into visiting it and crash the application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stack-based buffer overflow

Severity: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11760

CWE-ID: CWE-121 - Stack-based Buffer Overflow

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in nrappkit when doing WebRTC signaling. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Permissions, Privileges, and Access Controls

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11761

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the application allows access to a privileged JSONView object that had been cloned into content. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Heap-based buffer overflow

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2018-6156

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in WebRTC when handling malicious input. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Permissions, Privileges, and Access Controls

Severity: Low

CVSSv3: 4.1 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-17001

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document. A remote attacker can use such behavior in conjunction with XSS vulnerability on the website to bypass CSP protection using object tag when script-src 'none' is specified.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Cleartext transmission of sensitive information

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-17002

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software processes  upgrade-insecure-requests in the Content Security Policy, and a link is dragged and dropped from such page. As a result, the link is not upgraded to https and allows to transmit data over unencrypted channel.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2019-11764

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 60.0, 60.0.1, 60.0.2, 60.1.0, 60.2.0, 60.2.1, 60.2.2, 60.3.0, 60.4.0, 60.5.0, 60.5.1, 60.5.2, 60.6.0, 60.6.1, 60.6.2, 60.6.3, 60.7.0, 61.0, 61.0.1, 61.0.2, 62.0, 62.0.1, 62.0.2, 62.0.3, 63.0, 63.0.1, 63.0.3, 64.0, 64.0.1, 64.0.2, 65.0, 65.0.1, 65.0.2, 66.0, 66.0.1, 66.0.2, 66.0.3, 66.0.4, 66.0.5, 67.0, 67.0.1, 67.0.2, 67.0.3, 67.0.4, 68.0, 68.0.1, 68.0.2, 69.0, 69.0.1, 69.0.2, 69.0.3

CPE External links

https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.