CVE-2019-17019

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When Python was installed on Windows, a python file being served with the MIME type of text/plain could be executed by Python instead of being opened as a text file when the Open option was selected upon download. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 72.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Mozilla	Firefox	before 72

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1568003Permissions Required
https://www.mozilla.org/security/advisories/mfsa2020-01/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1568003Permissions Required
https://www.mozilla.org/security/advisories/mfsa2020-01/Vendor Advisory

Timeline

Published: Jan 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-17026.1Multiple vulnerabilities in the web-based management interface of Cisco Enterprise Chat and Email could allow an unauthenticated, remote att CVE-2019-170206.5If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be CVE-2019-170215.3During the initialization of a new content process, a race condition occurs that can allow a content process to disclose heap addresses from CVE-2019-170226.1When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Bec CVE-2019-170236.5After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in CVE-2019-170248.8Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corr CVE-2019-170258.8Mozilla developers reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume CVE-2019-170268.8Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted at CVE-2019-17038.6A vulnerability in the internal packet-processing functionality of Cisco Firepower Threat Defense (FTD) Software for the Cisco Firepower 210 CVE-2019-17047.5Multiple vulnerabilities in the Server Message Block (SMB) Protocol preprocessor detection engine for Cisco Firepower Threat Defense (FTD) S CVE-2019-170409.8contrib/pmdb2diag/pmdb2diag.c in Rsyslog v8.1908.0 allows out-of-bounds access because the level length is mishandled.CVE-2019-170419.8An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log