CVE-2019-9794
First published: Tue Mar 19 2019(Updated: )
A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handler for URLs. This could be used to retrieve and execute files whose location is supplied through these command line arguments if Firefox is configured as the default URI handler for a given URI scheme in third party applications and these applications insufficiently sanitize URL data. Note: This issue only affects Windows operating systems. Other operating systems are unaffected.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Thunderbird | <60.6 | 60.6 |
| Mozilla Firefox ESR | <60.6 | 60.6 |
| Mozilla Firefox | <66 | 66 |
| Mozilla Firefox | <66.0 | |
| Mozilla Firefox ESR | <60.6.0 | |
| Mozilla Thunderbird | <60.6.0 | |
| Microsoft Windows | ||
| All of | ||
| Any of | ||
| Mozilla Firefox | <66.0 | |
| Mozilla Firefox ESR | <60.6.0 | |
| Mozilla Thunderbird | <60.6.0 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1530103
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9788
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/
- https://www.mozilla.org/security/advisories/mfsa2019-07/
- https://www.mozilla.org/security/advisories/mfsa2019-08/
- https://www.mozilla.org/security/advisories/mfsa2019-11/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2019-9794.
What is the severity level of CVE-2019-9794?
The severity level of CVE-2019-9794 is critical.
Which software products are affected by CVE-2019-9794?
The software products affected by CVE-2019-9794 are Mozilla Firefox (version up to exclusive 66), Mozilla Thunderbird (version up to exclusive 60.6), and Mozilla Firefox ESR (version up to exclusive 60.6).
How can CVE-2019-9794 be exploited?
CVE-2019-9794 can be exploited by using specific command line arguments during Firefox invocation as a shell handler for URLs to retrieve and execute files.
Are Microsoft Windows systems vulnerable to CVE-2019-9794?
No, Microsoft Windows systems are not vulnerable to CVE-2019-9794.
- agent/type
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/first-publish-date
- agent/description
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/tags
- agent/event
- agent/softwarecombine
- agent/trending
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox esr
- canonical/mozilla firefox
- vendor/microsoft
- canonical/microsoft windows