Use-after-free in Mozilla Firefox - CVE-2019-11756

Vulnerability identifier: #VU23369

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11756

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing SFTKSession object. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error and crash the application or execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mozilla Firefox
Amazon Linux AMI
Arch Linux
Red Hat Enterprise Linux Server
CentOS
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Ansible Automation Platform
nss-softokn (Red Hat package)
nss (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
firefox (Ubuntu package)
nss-util (Red Hat package)
nss-softokn
nss-devel
nss-debuginfo
nss-debugsource
nss
nss-softokn-devel
nss-util
nss-util-devel
nspr (Red Hat package)
IBM Security Guardium
Data Computing Appliance (DCA)
OpenShift Virtualization
Red Hat OpenShift Container Platform

Install updates from vendor's website.

Mozilla Firefox - update to 71.0
Ansible Automation Platform - addressed in versions 1.0, 1.1, 1.2.4
nss-softokn (Red Hat package) - addressed in versions 3.28.3-10.el7_4, 3.36.0-7.el7_6, 3.44.0-9.el7_7, 3.53.1-6.el7_9
nss (Red Hat package) - addressed in versions 3.36.0-9.el7_6, 3.53.1-3.el7_9, 3.53.1-11.el8_2
firefox (Ubuntu package) - addressed in versions 71.0+build5-0ubuntu0.16.04.1, 71.0+build5-0ubuntu0.18.04.1, 71.0+build5-0ubuntu0.19.04.1, 71.0+build5-0ubuntu0.19.10.1
Data Computing Appliance (DCA) - addressed in versions Firmware tool 3H00, 4.2.1.0
OpenShift Virtualization - update to 2.4.2
nss-util (Red Hat package) - update to 3.53.1-1.el7_9
nss-softokn - update to 3.54.0-2
nss-devel - update to 3.54.0-2
nss-debuginfo - update to 3.54.0-2
nss-debugsource - update to 3.54.0-2
nss - update to 3.54.0-2
nss-softokn-devel - update to 3.54.0-2
nss-util - update to 3.54.0-2
nss-util-devel - update to 3.54.0-2
Red Hat OpenShift Container Platform - update to 4.3.40
nspr (Red Hat package) - addressed in versions 4.25.0-2.el7_9, 4.25.0-2.el8_2

• https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/

• Arch Linux update for firefox
• Multiple vulnerabilities in Mozilla Firefox and Firefox ESR
• Ubuntu update for Firefox
• Ubuntu update for Firefox
• Red Hat Enterprise Linux 7 update for nss and nspr
• Red Hat Enterprise Linux 7,4 update for nss-softokn
• Red Hat Enterprise Linux 7.6 update for nss and nss-softokn
• Red Hat Enterprise Linux 7.7 update for nss-softokn
• CentOS 7 update for nss
• Amazon Linux AMI update for nspr, nss-softokn, nss-util
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in IBM Security Guardium
• Red Hat Enterprise Linux 8 update for nss and nspr
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 1.2
• openEuler 20.03 LTS update for nss
• Multiple vulnerabilities in OpenShift Virtualization 2.4
• Multiple vulnerabilities in Ansible Automation Platform 1.0 packages
• Multiple vulnerabilities in Ansible Automation Platform 1.1 packages
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.3