CVE-2019-17011: Race Condition

Q: What is the vulnerability ID for this security issue?

The vulnerability ID for this security issue is CVE-2019-17011.

Q: What software is affected by this vulnerability?

This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Q: What is the severity of CVE-2019-17011?

The severity of CVE-2019-17011 is high (7.5).

Q: How can I fix the vulnerability CVE-2019-17011?

To fix the vulnerability CVE-2019-17011, update Thunderbird to version 68.3 or newer, or update Firefox ESR to version 68.3 or newer, or update Firefox to version 71 or newer.

Q: Where can I find more information about CVE-2019-17011?

You can find more information about CVE-2019-17011 on the Mozilla website.

Published Dec 3, 2019

Updated

Last updated 25 August 2025

Other sources

Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash.

Affected Software

15 affected componentsFixes available

redhat/firefox<68.3

68.3

redhat/thunderbird<68.3

68.3

Mozilla Firefox<71.0

Mozilla Firefox ESR<68.3

Mozilla Thunderbird<68.3

openSUSE Leap=15.1

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.10

Mozilla Thunderbird<68.3

68.3

Mozilla Firefox<71

Mozilla Firefox ESR<68.3

68.3

debian/firefox

149.0.2-1

debian/firefox-esr

115.14.0esr-1~deb11u1140.9.1esr-1~deb11u1128.14.0esr-1~deb12u1140.9.1esr-1~deb12u1140.8.0esr-1~deb13u1140.9.1esr-1~deb13u1140.9.1esr-1

debian/thunderbird

1:115.12.0-1~deb11u11:140.9.1esr-1~deb11u11:140.6.0esr-1~deb12u11:140.9.1esr-1~deb12u11:140.8.0esr-1~deb13u11:140.9.1esr-1~deb13u11:140.9.0esr-11:140.9.1esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 68.3
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 68.3
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 68.3
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 71
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 68.3
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 149.0.2-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 140.9.1esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.9.1esr-1~deb12u1Fixed in 140.8.0esr-1~deb13u1Fixed in 140.9.1esr-1~deb13u1Fixed in 140.9.1esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.9.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.9.1esr-1~deb12u1Fixed in 1:140.8.0esr-1~deb13u1Fixed in 1:140.9.1esr-1~deb13u1Fixed in 1:140.9.0esr-1Fixed in 1:140.9.1esr-1

Event History

Dec 3, 2019

CVE Published

12:00 AM

Jan 8, 2020

CVE Published

via MITRE·09:23 PM

Data Sourced

via MITRE·09:23 PM

DescriptionWeakness

Jan 11, 2024

Data Sourced

via Launchpad·11:22 PM

Description

Feb 20, 2026

Data Sourced

via Ubuntu·10:29 PM

RemedyDescriptionSeverityAffected Software

Apr 14, 2026

Data Sourced

via Debian·11:06 PM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this security issue?

The vulnerability ID for this security issue is CVE-2019-17011.

What software is affected by this vulnerability?

This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

What is the severity of CVE-2019-17011?

The severity of CVE-2019-17011 is high (7.5).

How can I fix the vulnerability CVE-2019-17011?

To fix the vulnerability CVE-2019-17011, update Thunderbird to version 68.3 or newer, or update Firefox ESR to version 68.3 or newer, or update Firefox to version 71 or newer.

Where can I find more information about CVE-2019-17011?

You can find more information about CVE-2019-17011 on the Mozilla website.

CVE-2019-17011: Race Condition

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this security issue?

What software is affected by this vulnerability?

What is the severity of CVE-2019-17011?

How can I fix the vulnerability CVE-2019-17011?

Where can I find more information about CVE-2019-17011?

Company

Resources

Contact