NVD Vulnerability Detail

CVE-2019-17021

Summary	During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. Note: this issue only occurs on Windows. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.
Publication Date	Jan. 9, 2020, 7:15 a.m.
Registration Date	Jan. 26, 2021, 11:40 a.m.
Last Update	Nov. 21, 2024, 1:31 p.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:15.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00029.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00043.html	Mailing List Third Party Advisory
5	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	Exploit Third Party Advisory VDB Entry
6	http://packetstormsecurity.com/files/155912/Slackware-Security-Advisory-mozilla-thunderbird-Updates.html	Exploit Third Party Advisory VDB Entry
7	https://bugzilla.mozilla.org/show_bug.cgi?id=1599008	Exploit Issue Tracking Permissions Required
8	https://bugzilla.mozilla.org/show_bug.cgi?id=1599008	Exploit Issue Tracking Permissions Required
9	https://seclists.org/bugtraq/2020/Jan/18	Mailing List Third Party Advisory
10	https://seclists.org/bugtraq/2020/Jan/18	Mailing List Third Party Advisory
11	https://www.mozilla.org/security/advisories/mfsa2020-01/	Vendor Advisory
12	https://www.mozilla.org/security/advisories/mfsa2020-01/	Vendor Advisory
13	https://www.mozilla.org/security/advisories/mfsa2020-02/	Vendor Advisory
14	https://www.mozilla.org/security/advisories/mfsa2020-02/	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-362	競合状態	https://cwe.mitre.org/data/definitions/362.html

JVN Vulnerability Information

Firefox における情報漏えいに関する脆弱性

Title	Firefox における情報漏えいに関する脆弱性
Summary	Firefox には、情報漏えいに関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 30, 2019, midnight
Registration Date	Jan. 23, 2020, 9:58 a.m.
Last Update	Jan. 23, 2020, 9:58 a.m.

Affected System

Mozilla Foundation

Mozilla Firefox 72 未満

Mozilla Firefox ESR 68.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-17021	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17021
National Vulnerability Database (NVD)
2	CVE-2019-17021	https://nvd.nist.gov/vuln/detail/CVE-2019-17021

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Mozilla Foundation Security Advisory
1	mfsa2020-01	https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/
2	mfsa2020-02	https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/

Change Log

No	Changed Details	Date of change
1	[2020年01月23日] 掲載	Jan. 23, 2020, 9:58 a.m.