CVE-2019-5849: High severity Mozilla Firefox vulnerability
An out-of-bounds read vulnerability exists in the Skia graphics library, allowing for the possible leaking of data from memory.
Other sources
Out of bounds read in Skia in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 69 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 75.0.3770.80 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 75.0.3770.80
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-11751
- CVE-2019-11746
- CVE-2019-11744
- CVE-2019-11742
- CVE-2019-11736
- CVE-2019-11753
- CVE-2019-11752
- CVE-2019-9812
- CVE-2019-11741
- CVE-2019-11743
- CVE-2019-11748
- CVE-2019-11749
- CVE-2019-5849
- CVE-2019-11750
- CVE-2019-11737
- CVE-2019-11738
- CVE-2019-11747
- CVE-2019-11734
- CVE-2019-11758
- CVE-2019-11735
- CVE-2019-11740
- CVE-2019-5828
- CVE-2019-5829
- CVE-2019-5830
- CVE-2019-5831
- CVE-2019-5832
- CVE-2019-5833
- CVE-2019-5834
- CVE-2019-5835
- CVE-2019-5836
- CVE-2019-5837
- CVE-2019-5838
- CVE-2019-5839
- CVE-2019-5840
Frequently Asked Questions
What is CVE-2019-5849?
CVE-2019-5849 is an out-of-bounds read vulnerability in the Skia graphics library that can lead to data leakage from memory.
Which software is affected by CVE-2019-5849?
Mozilla Firefox version up to exclusive 69 is affected by CVE-2019-5849.
What is the severity level of CVE-2019-5849?
CVE-2019-5849 has a medium severity level with a CVSS score of 4.
How can I fix CVE-2019-5849?
To fix CVE-2019-5849, update your Mozilla Firefox browser to version 69 or above.
Where can I find more information about CVE-2019-5849?
You can find more information about CVE-2019-5849 on the Mozilla bugzilla page (https://bugzilla.mozilla.org/show_bug.cgi?id=1555838) and the Mozilla security advisories page (https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/).