CVE-2019-9801
CVE-2019-9801
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS 5.3 · Medium · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
thunderbird
- Versions
- ≥ unspecified, < 60.6: Affected (custom)
Update to 60.6
firefox esr
- Versions
- ≥ unspecified, < 60.6: Affected (custom)
Update to 60.6
firefox
- Versions
- ≥ unspecified, < 66: Affected (custom)
Update to 66
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:20.04:LTS
- Versions
- 52.9.1-1build1
- 52.9.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published