CVE-2019-9801

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 66 Firefox ESR versions prior to 60.6 Thunderbird versions prior to 60.6

Description The issue affects Firefox on Windows operating systems, where it accepts any registered Program ID as an external protocol handler, offering to launch local applications when given a matching URL. This should only occur if the program has registered itself as a "URL Handler" in the Windows registry. The issue is specific to Windows operating systems, with other operating systems being unaffected.

Recommendations For Firefox versions prior to 66, update to version 66 or later to resolve the issue. For Firefox ESR versions prior to 60.6, update to version 60.6 or later to resolve the issue. For Thunderbird versions prior to 60.6, update to version 60.6 or later to resolve the issue.