CVE-2019-17021: mozilla firefox Race Condition

Vulnerability summary

CVE-2019-17021 is a medium (CVSS 5.3) Race Condition vulnerability in mozilla firefox. EPSS estimates a 1.87% chance of exploitation in the next 30 days, higher than 78.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 08-01-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.