CVE-2019-17021 — Race Condition in Mozilla Firefox

CWE-362 — Race ConditionCWE-200 — Sensitive Information Exposure10 documents8 sources
Severity
5.3MEDIUMNVD
EPSS
0.5%
top 35.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla Firefox ESROpensuse Leap
Timeline
PublishedJan 8
Latest updateMay 24

Description

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages5 packages

▶NVDmozilla/firefox< 72.0
▶CVEListV5mozilla/firefoxbefore 72
▶CVEListV5mozilla/firefox_esrbefore 68.4
▶NVDopensuse/leap15.1

🔴Vulnerability Details

3
GHSA
GHSA-23vm-fc59-7qjv: During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the paren↗2022-05-24
▶
OSV
CVE-2019-17021: During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the paren↗2020-01-08
▶
CVEList
CVE-2019-17021: During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the paren↗2020-01-08
▶

📋Vendor Advisories

5
Red Hat
Mozilla: Heap address disclosure in parent process during content process initialization on Windows↗2020-01-07
▶
Debian
CVE-2019-17021: firefox - During the initialization of a new content process, a race condition occurs that...↗2019
▶
Mozilla
Mozilla Foundation Security Advisory 2020-04: CVE-2019-17021↗
▶
Mozilla
Mozilla Foundation Security Advisory 2020-02: CVE-2019-17021↗
▶
Mozilla
Mozilla Foundation Security Advisory 2020-01: CVE-2019-17021↗
▶

💬Community

1
Bugzilla
CVE-2019-17021 Mozilla: Heap address disclosure in parent process during content process initialization on Windows↗2020-01-07
▶
CVE-2019-17021 — Race Condition in Mozilla Firefox | cvebase