Every CVE Search/ Get API key

CVE-2019-17009

When running, the updater service wrote status and log files to an unrestricted location;...

7.8 HighFix available

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.33%Down 14.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Record
CVE-2019-17009
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Record
CVE-2019-17009
Updated
2026-11-02
EUVDEUVD-2019-7483 No score

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Record
EUVD-2019-7483
Updated
2026-11-03
GitHub AdvisoriesGHSA-9wr8-jjcr-qw4x No score

When running, the updater service wrote status and log files to an unrestricted location;...

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Record
GHSA-9wr8-jjcr-qw4x
Updated
2026-11-02
OSVALPINE-CVE-2019-17009 7.8

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Record
ALPINE-CVE-2019-17009
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVUBUNTU-CVE-2019-17009 7.8

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Record
UBUNTU-CVE-2019-17009
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVMGASA-2019-0376 No score

Updated firefox packages fix security vulnerabilities

Updated firefox packages fix security vulnerabilities:

Stack corruption due to incorrect number of arguments in WebRTC code. (CVE-2019-13722)

Buffer overflow in plain text serializer. (CVE-2019-17005)

Use-after-free in worker destruction. (CVE-2019-17008)

Updater temporary files accessible to unprivileged processes. (CVE-2019-17009)

Use-after-free when performing device orientation checks. (CVE-2019-17010)

Use-after-free when retrieving a document in antitracking. (CVE-2019-17011)

Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3. (CVE-2019-17012)

Record
MGASA-2019-0376
Updated
2026-11-02
OSVMGASA-2019-0377 No score

Updated thunderbird packages fix security vulnerabilities

Updated thunderbird packages fix security vulnerabilities:

Stack corruption due to incorrect number of arguments in WebRTC code. (CVE-2019-13722)

Buffer overflow in plain text serializer. (CVE-2019-17005)

Use-after-free in worker destruction. (CVE-2019-17008)

Updater temporary files accessible to unprivileged processes. (CVE-2019-17009)

Use-after-free when performing device orientation checks. (CVE-2019-17010)

Use-after-free when retrieving a document in antitracking. (CVE-2019-17011)

Memory safety bugs fixed in Firefox 71, Firefox ESR 68.3, and Thunderbird 68.3. (CVE-2019-17012)

Record
MGASA-2019-0377
Updated
2026-11-02
OSVopenSUSE-SU-2020:0002-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

  • CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
  • CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
  • CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
  • CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
  • CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
  • CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
  • CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
  • CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0002-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0003-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)

Security issues fixed:

  • CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
  • CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
  • CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
  • CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
  • CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
  • CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
  • CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
  • CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Other issues addressed:

  • New: Message display toolbar action WebExtension API (bmo#1531597)
  • New: Navigation buttons are now available in content tabs (bmo#787683)
  • Fixed an issue where write window was not always correct (bmo#1593280)
  • Fixed toolbar issues (bmo#1584160)
  • Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)
  • Fixed an issue with scam link confirmation panel (bmo#1596413)
  • Fixed an issue with the write window where the Link Properties dialog was not showing named anchors in context menu (bmo#1593629)
  • Fixed issues with calendar (bmo#1588516)
  • Fixed issues with chat where reordering via drag-and-drop was not working on Instant messaging status dialog (bmo#1591505)

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0003-1
Updated
2026-11-02
OSVSUSE-SU-2019:14260-1 No score

Security update for MozillaFirefox, mozilla-nspr, mozilla-nss

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:

Update Firefox Extended Support Release to 68.3.0 ESR (MFSA 2019-37 / bsc#1158328)

Security issues fixed:

  • CVE-2019-17008: Use-after-free in worker destruction (bmo#1546331).
  • CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156).
  • CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher (bmo#1586176).
  • CVE-2019-17009: Updater temporary files accessible to unprivileged processes (bmo#1510494).
  • CVE-2019-17010: Use-after-free when performing device orientation checks (bmo#1581084).
  • CVE-2019-17005: Buffer overflow in plain text serializer (bmo#1584170).
  • CVE-2019-17011: Use-after-free when retrieving a document in antitracking (bmo#1591334).
  • CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502).

Update mozilla-nss to version 3.47.1 (bsc#1158527):

Security issues fixed:

  • CVE-2019-11745: EncryptUpdate should use maxout, not block size.

Bug fixes:

  • Fix a crash that could be caused by client certificates during startup (bmo#1590495, bsc#1158527)
  • Fix compile-time warnings from uninitialized variables in a perl script (bmo#1589810)
  • Support AES HW acceleration on ARMv8 (bmo#1152625)
  • Allow per-socket run-time ordering of the cipher suites presented in ClientHello (bmo#1267894)
  • Add CMAC to FreeBL and PKCS #11 libraries (bmo#1570501)
  • Remove arbitrary HKDF output limit by allocating space as needed (bmo#1577953)

Update mozilla-nspr to version 4.23:

Bug fixes:

  • fixed a build failure that was introduced in 4.22
  • correctness fix for Win64 socket polling
  • whitespace in C files was cleaned up and no longer uses tab characters for indenting
  • added support for the ARC architecture
  • removed support for the following platforms: OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
  • correctness and build fixes
Record
SUSE-SU-2019:14260-1
Updated
2026-11-02
OSVSUSE-SU-2019:3337-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

  • CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
  • CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
  • CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
  • CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
  • CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
  • CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
  • CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
  • CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)
Record
SUSE-SU-2019:3337-1
Updated
2026-11-02
OSVSUSE-SU-2019:3339-1 No score

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)

Security issues fixed:

  • CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
  • CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
  • CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
  • CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
  • CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
  • CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
  • CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
  • CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Other issues addressed:

  • New: Message display toolbar action WebExtension API (bmo#1531597)
  • New: Navigation buttons are now available in content tabs (bmo#787683)
  • Fixed an issue where write window was not always correct (bmo#1593280)
  • Fixed toolbar issues (bmo#1584160)
  • Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)
  • Fixed an issue with scam link confirmation panel (bmo#1596413)
  • Fixed an issue with the write window where the Link Properties dialog was not showing named anchors in context menu (bmo#1593629)
  • Fixed issues with calendar (bmo#1588516)
  • Fixed issues with chat where reordering via drag-and-drop was not working on Instant messaging status dialog (bmo#1591505)
Record
SUSE-SU-2019:3339-1
Updated
2026-11-02
OSVSUSE-SU-2019:3347-1 No score

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

  • CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
  • CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
  • CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
  • CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
  • CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
  • CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
  • CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
  • CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)
Record
SUSE-SU-2019:3347-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.11
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.12
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.13
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.14
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.15
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.16
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.17
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.18
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.19
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.20
 before 68.3.0-r0
68.3.0-r0
Show 40 moreShow less
Affected packages
PackageAffectedFixed
firefox-esr
Alpine:v3.21
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.22
 before 68.3.0-r0
68.3.0-r0
firefox-esr
Alpine:v3.23
 before 68.3.0-r0
68.3.0-r0
firefox
Mageia:7
From an advisory covering 7 CVEs
 before 68.3.0-1.mga7
68.3.0-1.mga7
firefox-l10n
Mageia:7
From an advisory covering 7 CVEs
 before 68.3.0-1.mga7
68.3.0-1.mga7
nspr
Mageia:7
From an advisory covering 7 CVEs
 before 4.24-1.mga7
4.24-1.mga7
thunderbird
Mageia:7
From an advisory covering 7 CVEs
 before 68.3.0-1.mga7
68.3.0-1.mga7
thunderbird-l10n
Mageia:7
From an advisory covering 7 CVEs
 before 68.3.0-1.mga7
68.3.0-1.mga7
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 68.3.0-78.54.1
68.3.0-78.54.1
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 4.23-29.9.1
4.23-29.9.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
From an advisory covering 8 CVEs
 before 3.47.1-38.12.1
3.47.1-38.12.1
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 8 CVEs
 before 68.3.0-3.62.2
68.3.0-3.62.2
MozillaFirefox
SUSE:Linux Enterprise Module for Desktop Applications 15 SP1
From an advisory covering 8 CVEs
 before 68.3.0-3.62.2
68.3.0-3.62.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15
From an advisory covering 8 CVEs
 before 68.3.0-3.61.2
68.3.0-3.61.2
MozillaThunderbird
SUSE:Linux Enterprise Workstation Extension 15 SP1
From an advisory covering 8 CVEs
 before 68.3.0-3.61.2
68.3.0-3.61.2
MozillaFirefox
SUSE:HPE Helion OpenStack 8
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:OpenStack Cloud 7
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:OpenStack Cloud 8
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:OpenStack Cloud Crowbar 8
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1-LTSS
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-LTSS
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP3-BCL
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server 12 SP5
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
MozillaFirefox
SUSE:Enterprise Storage 5
From an advisory covering 8 CVEs
 before 68.3.0-109.98.1
68.3.0-109.98.1
mozjs52
Ubuntu:18.04:LTS
 All versions, plus listed versions
52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1
 None known
mozjs38
Ubuntu:18.04:LTS
 All versions, plus listed versions
38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4
 None known
mozjs52
Ubuntu:20.04:LTS
 All versions, plus listed versions
52.9.1-1build152.9.1-1ubuntu3
 None known
MozillaFirefox
openSUSE:Leap 15.1
From an advisory covering 8 CVEs
 before 68.3.0-lp151.2.21.1
68.3.0-lp151.2.21.1
MozillaThunderbird
openSUSE:Leap 15.1
From an advisory covering 8 CVEs
 before 68.3.0-lp151.2.19.1
68.3.0-lp151.2.19.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17009 is a high vulnerability (CVSS 7.8) in Mozilla Firefox, published December 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in firefox-esr 68.3.0-r0.

References

Show 31 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open