Memory corruption in Mozilla Firefox - CVE-2019-9794

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18033

Memory corruption in Mozilla Firefox - CVE-2019-9794

Published: March 21, 2019 / Updated: March 21, 2019


Vulnerability identifier: #VU18033
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9794
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper validation of command line arguments within the URI handler when opening documents with Firefox. A remote attacker can trick the victim to open a file with a specially crafted filename and execute arbitrary commands on the system.

Note, this vulnerability can be exploited against Firefox installations on Windows operating system only.

Affected software

Mozilla Firefox
Firefox ESR
SUSE Package Hub for SUSE Linux Enterprise
Opensuse
Mozilla Thunderbird
firefox-esr (Alpine package)

How to mitigate CVE-2019-9794

Install updates from vendor's website.

Mozilla Firefox - update to 66.0
Firefox ESR - update to 60.6.0
Mozilla Thunderbird - update to 60.6.0
firefox-esr (Alpine package) - update to 60.6.1-r0

External References

Related Security Bulletins