CVE-2019-11707

HIGH

Description

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1544386

https://security.gentoo.org/glsa/201908-12

https://www.mozilla.org/security/advisories/mfsa2019-18/

https://www.mozilla.org/security/advisories/mfsa2019-20/

Details

Source: MITRE

Published: 2019-07-23

Updated: 2020-08-24

Type: CWE-843

Risk Information

CVSS v2.0

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3.0

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.8

Severity: HIGH

Tenable Plugins

View all (54 total)

ID	Name	Product	Family	Severity
134411	NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2020-0017)	Nessus	NewStart CGSL Local Security Checks	critical
134410	NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2020-0022)	Nessus	NewStart CGSL Local Security Checks	critical
128698	NewStart CGSL MAIN 4.06 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0178)	Nessus	NewStart CGSL Local Security Checks	critical
128691	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2019-0175)	Nessus	NewStart CGSL Local Security Checks	critical
127961	GLSA-201908-12 : Mozilla Firefox: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
127596	Oracle Linux 8 : firefox (ELSA-2019-1696)	Nessus	Oracle Linux Local Security Checks	critical
127595	Oracle Linux 8 : thunderbird (ELSA-2019-1623)	Nessus	Oracle Linux Local Security Checks	critical
127448	NewStart CGSL CORE 5.05 / MAIN 5.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0164)	Nessus	NewStart CGSL Local Security Checks	critical
127447	NewStart CGSL CORE 5.05 / MAIN 5.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0163)	Nessus	NewStart CGSL Local Security Checks	critical
127442	NewStart CGSL CORE 5.04 / MAIN 5.04 : firefox Multiple Vulnerabilities (NS-SA-2019-0161)	Nessus	NewStart CGSL Local Security Checks	critical
127441	NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0160)	Nessus	NewStart CGSL Local Security Checks	critical
126962	Amazon Linux 2 : thunderbird (ALAS-2019-1250)	Nessus	Amazon Linux Local Security Checks	critical
126558	RHEL 8 : firefox (RHSA-2019:1696)	Nessus	Red Hat Local Security Checks	critical
126465	Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : thunderbird vulnerabilities (USN-4045-1)	Nessus	Ubuntu Local Security Checks	critical
126435	Scientific Linux Security Update : thunderbird on SL7.x x86_64 (20190627)	Nessus	Scientific Linux Local Security Checks	critical
126434	Scientific Linux Security Update : firefox on SL7.x x86_64 (20190626)	Nessus	Scientific Linux Local Security Checks	critical
126389	CentOS 7 : thunderbird (CESA-2019:1626)	Nessus	CentOS Local Security Checks	critical
126388	CentOS 6 : thunderbird (CESA-2019:1624)	Nessus	CentOS Local Security Checks	critical
126386	CentOS 6 : firefox (CESA-2019:1604)	Nessus	CentOS Local Security Checks	critical
126385	CentOS 7 : firefox (CESA-2019:1603)	Nessus	CentOS Local Security Checks	critical
126366	Scientific Linux Security Update : thunderbird on SL6.x i386/x86_64 (20190627)	Nessus	Scientific Linux Local Security Checks	critical
126321	RHEL 7 : thunderbird (RHSA-2019:1626)	Nessus	Red Hat Local Security Checks	critical
126320	RHEL 6 : thunderbird (RHSA-2019:1624)	Nessus	Red Hat Local Security Checks	critical
126319	RHEL 8 : thunderbird (RHSA-2019:1623)	Nessus	Red Hat Local Security Checks	critical
126318	Oracle Linux 7 : thunderbird (ELSA-2019-1626)	Nessus	Oracle Linux Local Security Checks	critical
126317	Oracle Linux 6 : thunderbird (ELSA-2019-1624)	Nessus	Oracle Linux Local Security Checks	critical
126303	Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190626)	Nessus	Scientific Linux Local Security Checks	critical
126300	Oracle Linux 6 : firefox (ELSA-2019-1604)	Nessus	Oracle Linux Local Security Checks	critical
126252	RHEL 6 : firefox (RHSA-2019:1604)	Nessus	Red Hat Local Security Checks	critical
126251	RHEL 7 : firefox (RHSA-2019:1603)	Nessus	Red Hat Local Security Checks	critical
126249	Oracle Linux 7 : firefox (ELSA-2019-1603)	Nessus	Oracle Linux Local Security Checks	critical
126247	Debian DLA-1836-1 : thunderbird security update	Nessus	Debian Local Security Checks	critical
126231	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-1606)	Nessus	SuSE Local Security Checks	critical
126224	Debian DSA-4471-1 : thunderbird - security update	Nessus	Debian Local Security Checks	critical
126218	Mozilla Thunderbird < 60.7.2	Nessus	Windows	critical
126217	Mozilla Thunderbird < 60.7.2	Nessus	MacOS X Local Security Checks	critical
126164	SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:1629-1)	Nessus	SuSE Local Security Checks	high
126147	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-1594)	Nessus	SuSE Local Security Checks	critical
126146	openSUSE Security Update : MozillaFirefox (openSUSE-2019-1593)	Nessus	SuSE Local Security Checks	high
126137	FreeBSD : Mozilla -- multiple vulnerabilities (49beb00f-a6e1-4a42-93df-9cb14b4c2bee)	Nessus	FreeBSD Local Security Checks	critical
126133	Fedora 30 : gjs / mozjs60 (2019-c2ff49ef73)	Nessus	Fedora Local Security Checks	critical
126094	Slackware 14.2 / current : mozilla-thunderbird (SSA:2019-172-02)	Nessus	Slackware Local Security Checks	high
126080	Fedora 29 : firefox (2019-9d9ad2999e)	Nessus	Fedora Local Security Checks	high
126078	Debian DLA-1829-1 : firefox-esr security update	Nessus	Debian Local Security Checks	high
126055	Fedora 30 : firefox (2019-2cac67b3bc)	Nessus	Fedora Local Security Checks	high
126032	Slackware 14.2 / current : mozilla-firefox (SSA:2019-169-02)	Nessus	Slackware Local Security Checks	high
126019	FreeBSD : mozilla -- multiple vulnerabilities (0cea6e0a-7a39-4dac-b3ec-dbc13d404f76)	Nessus	FreeBSD Local Security Checks	high
126012	Debian DSA-4466-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	high
700741	Mozilla Firefox ESR < 60.7.1 Security Vulnerability	Nessus Network Monitor	Web Clients	medium
700740	Mozilla Firefox < 67.0.3 Security Vulnerability	Nessus Network Monitor	Web Clients	medium
126002	Mozilla Firefox < 67.0.3	Nessus	Windows	high
126001	Mozilla Firefox ESR < 60.7.1	Nessus	Windows	high
126000	Mozilla Firefox < 67.0.3	Nessus	MacOS X Local Security Checks	high
125999	Mozilla Firefox ESR < 60.7.1	Nessus	MacOS X Local Security Checks	high