High severity · published Jul 23, 2019
CVE-2019-11707
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
In wildKEV
8.8
CVSS
38%
EPSS
Yes
On KEV
Description
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)38.0% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed May 23, 2022
Federal remediation dueJun 13, 2022
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
before 67.0.3 · source: vendor, NVD
FE
Firefox ESR · Mozilla
before 60.7.1 · source: vendor
TH
Thunderbird · Mozilla
before 60.7.2 · source: vendor, NVD
FA
Firefox and Thunderbird · Mozilla
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-11707
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-11707
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.mozilla.org/security/advisories/mfsa2019-20/
x_refsource_MISC
https://www.mozilla.org/security/advisories/mfsa2019-18/
x_refsource_MISC
https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
vendor-advisory
https://security.gentoo.org/glsa/201908-12
More from Firefox
10.0
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
9.8
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.6
CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability
8.8
CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability