Ref# Mozilla | Date: Dec 6th 2019

---

Description

Microsoft has release updates to address a vulnerability in Firefox and Firefox ESR, and Thunderbird. It is recommended that you take the necessary precautions by ensuring your products are always updated.

Security vulnerabilities fixed in Firefox 71

High

• CVE-2019-11756: Use-after-free of SFTKSession object
  https://bugzilla.mozilla.org/show_bug.cgi?id=1508776 
• CVE-2019-17008: Use-after-free in worker destruction
  https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 
• CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code
  https://bugzilla.mozilla.org/show_bug.cgi?id=1580156 
• CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher
  https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 
• CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3
  https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957 %2C1560667%2C1567209%2C1580288%2C1585760%2C1592502 
• CVE-2019-17013: Memory safety bugs fixed in Firefox 71
  https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328 %2C1577439%2C1577937%2C1580320%2C1584195%2C1585106 %2C1586293%2C1593865%2C1594181 

Moderate

• CVE-2019-17014: Dragging and dropping a cross-origin resource, incorrectly loaded as an image, could result in information disclosure
   https://bugzilla.mozilla.org/show_bug.cgi?id=1322864 
• CVE-2019-17009: Updater temporary files accessible to unprivileged processes
  https://bugzilla.mozilla.org/show_bug.cgi?id=1510494 
• CVE-2019-17010: Use-after-free when performing device orientation checks
  https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 
• CVE-2019-17005: Buffer overflow in plain text serializer
  https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 
• CVE-2019-17011: Use-after-free when retrieving a document in antitracking
  https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 

Security vulnerabilities fixed in Firefox ESR 68.3

High

• CVE-2019-17008: Use-after-free in worker destruction
  https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 
• CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code
  https://bugzilla.mozilla.org/show_bug.cgi?id=1580156 
• CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher
  https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 
• CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3
  https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957 %2C1560667%2C1567209%2C1580288%2C1585760%2C1592502 

Moderate

• CVE-2019-17009: Updater temporary files accessible to unprivileged processes
  https://bugzilla.mozilla.org/show_bug.cgi?id=1510494
• CVE-2019-17010: Use-after-free when performing device orientation checks
  https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 
• CVE-2019-17005: Buffer overflow in plain text serializer
  https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 
• CVE-2019-17011: Use-after-free when retrieving a document in antitracking
  https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 

Security Vulnerabilities fixed in Thunderbird 68.3

High

• CVE-2019-17008: Use-after-free in worker destruction
  https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 
• CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code
  https://bugzilla.mozilla.org/show_bug.cgi?id=1580156 
• CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher 
  https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 
• CVE-2019-17012: Memory safety bugs fixed in Firefox 71, Firefox ESR 68.3, and Thunderbird 68.3
  https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957 %2C1560667%2C1567209%2C1580288%2C1585760%2C1592502 

Moderate

• CVE-2019-17009: Updater temporary files accessible to unprivileged processes
  https://bugzilla.mozilla.org/show_bug.cgi?id=1510494 
• CVE-2019-17010: Use-after-free when performing device orientation checks
  https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 
• CVE-2019-17005: Buffer overflow in plain text serializer
  https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 
• CVE-2019-17011: Use-after-free when retrieving a document in antitracking
  https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 

The Guyana National CIRT recommends users and administration to follow these guidelines and to apply them where necessary.

Reference

• Mozilla Releases Security Updates for Firefox and Firefox ESR (December 04th, 2019)

         https://www.us-cert.gov/ncas/current-activity/2019/12/04/mozilla-rele ases-security-updates-firefox-and-firefox-esr