CVE-2019-17010

Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*

History

08 Apr 2022, 14:32

Type Values Removed Values Added
CWE CWE-416 CWE-362
CPE cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
References (REDHAT) https://access.redhat.com/errata/RHSA-2020:0295 - (REDHAT) https://access.redhat.com/errata/RHSA-2020:0295 - Third Party Advisory
References (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 - Permissions Required (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 - Exploit, Issue Tracking, Vendor Advisory
References (REDHAT) https://access.redhat.com/errata/RHSA-2020:0292 - (REDHAT) https://access.redhat.com/errata/RHSA-2020:0292 - Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4241-1/ - (UBUNTU) https://usn.ubuntu.com/4241-1/ - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202003-02 - (GENTOO) https://security.gentoo.org/glsa/202003-02 - Third Party Advisory
References (UBUNTU) https://usn.ubuntu.com/4335-1/ - (UBUNTU) https://usn.ubuntu.com/4335-1/ - Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202003-10 - (GENTOO) https://security.gentoo.org/glsa/202003-10 - Third Party Advisory
First Time Canonical ubuntu Linux
Canonical

Information

Published : 2020-01-08 22:15

Updated : 2023-12-10 13:13


NVD link : CVE-2019-17010

Mitre link : CVE-2019-17010

CVE.ORG link : CVE-2019-17010


JSON object : View

Products Affected

opensuse

  • leap

mozilla

  • firefox_esr
  • thunderbird
  • firefox

canonical

  • ubuntu_linux
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')