Permissions, Privileges, and Access Controls in Mozilla Firefox - CVE-2019-9801
Published: March 21, 2019 / Updated: March 21, 2019
Vulnerability identifier: #VU18039
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9801
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to Firefox accepts any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. A remote attacker can trick the victim to open a specially crafted link and execute an arbitrary application on the system with privileges of the current user.
Note: this vulnerability affects Windows operating system only.
Affected software
Mozilla Firefox
Firefox ESR
SUSE Package Hub for SUSE Linux Enterprise
Opensuse
Mozilla Thunderbird
firefox-esr (Alpine package)
Firefox ESR
SUSE Package Hub for SUSE Linux Enterprise
Opensuse
Mozilla Thunderbird
firefox-esr (Alpine package)
How to mitigate CVE-2019-9801
Install updates from vendor's website.
Mozilla Firefox - update to 66.0
Mozilla Thunderbird - update to 60.6.0
Firefox ESR - update to 60.6.0
firefox-esr (Alpine package) - update to 60.6.1-r0
Mozilla Thunderbird - update to 60.6.0
Firefox ESR - update to 60.6.0
firefox-esr (Alpine package) - update to 60.6.1-r0
External References
Related Security Bulletins
- Multiple vulnerabilities in Mozilla Firefox
- Multiple vulnerabilities in Mozilla Firefox ESR
- Multiple vulnerabilities in Mozilla Thunderbird
- OpenSUSE Linux update for MozillaThunderbird
- OpenSUSE Linux update for MozillaThunderbird
- Permissions, Privileges, and Access Controls in firefox-esr (Alpine package)