CVE-2019-17017: High severity Mozilla Thunderbird vulnerability

Q: What is CVE-2019-17017?

CVE-2019-17017 is a vulnerability that can result in a crash due to a missing case handling object types, potentially allowing an attacker to run arbitrary code.

Q: Which software is affected by CVE-2019-17017?

Mozilla Firefox ESR version up to 68.4, Mozilla Thunderbird version up to 68.4.1, and Mozilla Firefox version up to 72 are affected by CVE-2019-17017.

Q: What is the severity of CVE-2019-17017?

CVE-2019-17017 has a severity level of high (7).

Q: How can CVE-2019-17017 be exploited?

CVE-2019-17017 could be exploited to run arbitrary code, but it would require a significant amount of effort.

Q: How can I fix CVE-2019-17017?

To fix CVE-2019-17017, update Mozilla Firefox ESR to version 68.4 or later, update Mozilla Thunderbird to version 68.4.1 or later, or update Mozilla Firefox to version 72 or later.

Published Jan 7, 2020

Updated

Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.

Affected Software

41 affected componentsFixes available

redhat/firefox<68.4

68.4

redhat/thunderbird<68.4.1

68.4.1

Mozilla Thunderbird<68.4.1

68.4.1

Mozilla Firefox<72

Mozilla Firefox ESR<68.4

68.4

Mozilla Firefox<72.0

Mozilla Firefox ESR<68.4

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Canonical Ubuntu Linux=19.04

Canonical Ubuntu Linux=19.10

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Debian Debian Linux=10.0

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Aus=7.7

redhat Enterprise Linux Server Tus=7.7

redhat Enterprise Linux Workstation=6.0

redhat Enterprise Linux Workstation=7.0

debian/firefox

149.0.2-1

debian/firefox-esr

115.14.0esr-1~deb11u1140.9.1esr-1~deb11u1128.14.0esr-1~deb12u1140.9.1esr-1~deb12u1140.8.0esr-1~deb13u1140.9.1esr-1~deb13u1140.9.1esr-1

debian/thunderbird

1:115.12.0-1~deb11u11:140.9.1esr-1~deb11u11:140.6.0esr-1~deb12u11:140.9.1esr-1~deb12u11:140.8.0esr-1~deb13u11:140.9.1esr-1~deb13u11:140.9.0esr-11:140.9.1esr-1

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/firefox<71.0.1-r0

71.0.1-r0

alpine/librewolf<71.0.1-r0

71.0.1-r0

alpine/librewolf<71.0.1-r0

71.0.1-r0

alpine/librewolf<71.0.1-r0

71.0.1-r0

alpine/librewolf<71.0.1-r0

71.0.1-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/firefox to a version that resolves this vulnerability.
Fixed in 68.4
Upgrade
Upgrade redhat/thunderbird to a version that resolves this vulnerability.
Fixed in 68.4.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 68.4.1
Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 72
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 68.4
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 149.0.2-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 115.14.0esr-1~deb11u1Fixed in 140.9.1esr-1~deb11u1Fixed in 128.14.0esr-1~deb12u1Fixed in 140.9.1esr-1~deb12u1Fixed in 140.8.0esr-1~deb13u1Fixed in 140.9.1esr-1~deb13u1Fixed in 140.9.1esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:115.12.0-1~deb11u1Fixed in 1:140.9.1esr-1~deb11u1Fixed in 1:140.6.0esr-1~deb12u1Fixed in 1:140.9.1esr-1~deb12u1Fixed in 1:140.8.0esr-1~deb13u1Fixed in 1:140.9.1esr-1~deb13u1Fixed in 1:140.9.0esr-1Fixed in 1:140.9.1esr-1
Upgrade
Upgrade alpine/firefox to a version that resolves this vulnerability.
Fixed in 71.0.1-r0
Upgrade
Upgrade alpine/librewolf to a version that resolves this vulnerability.
Fixed in 71.0.1-r0

Event History

Jan 7, 2020

CVE Published

12:00 AM

Jan 8, 2020

CVE Published

via MITRE·09:27 PM

Data Sourced

via MITRE·09:27 PM

DescriptionWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·10:15 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2019-17017?

CVE-2019-17017 is a vulnerability that can result in a crash due to a missing case handling object types, potentially allowing an attacker to run arbitrary code.

Which software is affected by CVE-2019-17017?

Mozilla Firefox ESR version up to 68.4, Mozilla Thunderbird version up to 68.4.1, and Mozilla Firefox version up to 72 are affected by CVE-2019-17017.

What is the severity of CVE-2019-17017?

CVE-2019-17017 has a severity level of high (7).

How can CVE-2019-17017 be exploited?

CVE-2019-17017 could be exploited to run arbitrary code, but it would require a significant amount of effort.

How can I fix CVE-2019-17017?

To fix CVE-2019-17017, update Mozilla Firefox ESR to version 68.4 or later, update Mozilla Thunderbird to version 68.4.1 or later, or update Mozilla Firefox to version 72 or later.

CVE-2019-17017: High severity Mozilla Thunderbird vulnerability

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2019-17017?

Which software is affected by CVE-2019-17017?

What is the severity of CVE-2019-17017?

How can CVE-2019-17017 be exploited?

How can I fix CVE-2019-17017?

Company

Resources

Contact