---

CVE-2019-9802 - log back

CVE-2019-9802 created at 25 Sep 2019 19:31:40
Severity	+ Medium
Remote	+ Remote
Type	+ Information disclosure
Description	+ If a Sandbox content process is compromised in Firefox before 66.0, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process, which may include sensitive data.
References	+ https://www.mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9802 + https://bugzilla.mozilla.org/show_bug.cgi?id=1415508
Notes