CVE-2019-17017

Published: Jan 8, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

Affected (17)

Products: Mozilla: Firefox, Firefox Esr · Canonical: Ubuntu Linux · Debian: Debian Linux · +1 more

Show all products

Mozilla: Firefox, Firefox Esr · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Tus, Enterprise Linux Workstation

2 products

1 product

1 product

5 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 72.0
Mozilla Firefox Esr	Before 68.4

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04
Canonical Ubuntu Linux	Version 19.10

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.7
Redhat Enterprise Linux Server Tus	Version 7.7
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

References (50)

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html

Source: security@mozilla.org

http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2020:0085

Source: security@mozilla.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0086

Source: security@mozilla.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0111

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2020:0120

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2020:0123

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2020:0127

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2020:0292

Source: security@mozilla.org

https://access.redhat.com/errata/RHSA-2020:0295

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1603055

Source: security@mozilla.org

Permissions Required

https://lists.debian.org/debian-lts-announce/2020/01/msg00005.html

Source: security@mozilla.org

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2020/01/msg00016.html

Source: security@mozilla.org

https://seclists.org/bugtraq/2020/Jan/12

Source: security@mozilla.org

Mailing ListThird Party Advisory

https://seclists.org/bugtraq/2020/Jan/18

Source: security@mozilla.org

Third Party Advisory

https://seclists.org/bugtraq/2020/Jan/26

Source: security@mozilla.org

https://security.gentoo.org/glsa/202003-02

Source: security@mozilla.org

https://usn.ubuntu.com/4234-1/

Source: security@mozilla.org

Third Party Advisory

https://usn.ubuntu.com/4241-1/

Source: security@mozilla.org

https://usn.ubuntu.com/4335-1/

Source: security@mozilla.org

https://www.debian.org/security/2020/dsa-4600

Source: security@mozilla.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4603

Source: security@mozilla.org

https://www.mozilla.org/security/advisories/mfsa2020-01/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2020-02/

Source: security@mozilla.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html