Permissions, Privileges, and Access Controls in Mozilla Firefox - CVE-2019-9812
Published: September 3, 2019 / Updated: September 6, 2019
Vulnerability identifier: #VU20824
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9812
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escape sandbox restrictions.
The vulnerability exists due to a combination of issues related to a compromised sandboxed content and the Firefox Sync ability to synchronize data with the malicious account. A remote attacker can can compromise a sandboxed content process using a different vulnerability, and then escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered.
Affected software
Mozilla Firefox
Firefox ESR
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
firefox (Ubuntu package)
firefox-esr (Alpine package)
firefox-esr (Debian package)
Firefox ESR
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
firefox (Ubuntu package)
firefox-esr (Alpine package)
firefox-esr (Debian package)
How to mitigate CVE-2019-9812
Install updates from vendor's website.
Mozilla Firefox - update to 69.0
firefox (Ubuntu package) - addressed in versions 69.0+build2-0ubuntu0.16.04.4, 69.0+build2-0ubuntu0.18.04.1, 69.0+build2-0ubuntu0.19.04.1, 69.0.2+build1-0ubuntu0.16.04.1, 69.0.2+build1-0ubuntu0.18.04.1, 69.0.2+build1-0ubuntu0.19.04.1
Firefox ESR - addressed in versions 60.9.0, 68.1.0
firefox-esr (Alpine package) - update to 60.9.0-r0
firefox-esr (Debian package) - update to 60.9.0esr-1~deb10u1
firefox (Ubuntu package) - addressed in versions 69.0+build2-0ubuntu0.16.04.4, 69.0+build2-0ubuntu0.18.04.1, 69.0+build2-0ubuntu0.19.04.1, 69.0.2+build1-0ubuntu0.16.04.1, 69.0.2+build1-0ubuntu0.18.04.1, 69.0.2+build1-0ubuntu0.19.04.1
Firefox ESR - addressed in versions 60.9.0, 68.1.0
firefox-esr (Alpine package) - update to 60.9.0-r0
firefox-esr (Debian package) - update to 60.9.0esr-1~deb10u1
External References
Related Security Bulletins
- Multiple vulnerabilities in Mozilla Firefox
- Multiple vulnerabilities in Mozilla Firefox ESR
- Multiple vulnerabilities in Mozilla Firefox ESR
- Arch Linux update for firefox
- Ubuntu update for Firefox
- Red Hat update for firefox
- Red Hat update for firefox
- Red Hat update for firefox
- Debian update for firefox-esr
- Ubuntu regressions update for Firefox
- Gentoo update for Mozilla Firefox
- Permissions, Privileges, and Access Controls in firefox-esr (Alpine package)