UBUNTU-CVE-2019-9812

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-9812

    UBUNTU-CVE-2019-9812

    Published: 4 Sept 2019Last Modified: 22 Apr 2026
    Upstream:
    CVE-2019-9812
    Aliases:
    USN-4122-1

    Summary:

    Details: Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69.

    References: https://ubuntu.com/security/CVE-2019-9812, https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/#CVE-2019-9812, https://ubuntu.com/security/notices/USN-4122-1, https://www.cve.org/CVERecord?id=CVE-2019-9812

    Affected packages

    Package

    Name: firefox

    Purl: pkg:deb/ubuntu/[email protected]+build2-0ubuntu0.16.04.4?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -69.0+build2-0ubuntu0.16.04.4

    Affected versions

    41.0.2+build2-0ubuntu1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High