CVE-2019-17021

Mozilla: Heap address disclosure in parent process during content process initialization on Windows

Loading…

Severity

Moderate

Red Hat Product Security

6.1

CVSS 3.0

Review impact separately from score.

Published · January 7, 2020

Updated · November 22, 2025

Description

During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from the parent process. Note: this issue only occurs on Windows. Other operating systems are unaffected.. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')