CVE-2019-11707
Mozilla Firefox and Thunderbird: Type Confusion
As of , CVE-2019-11707 in Mozilla Firefox and Thunderbird is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.
- Exploited
- Yes: CISA listed it on 23 May 2022
- US federal deadline
- 13 June 202221 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.38Higher than 98% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.33 on 23 May 2022EPSS on the day CISA listed it.
- Public exploit
- 2 Exploit-DB entries (1 verified)
- Fix
- No vendor link in CISA's entry
What CISA says to do
Apply updates per vendor instructions.
CISA's required action
What the flaw is
Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
CISA's description
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
The CVE record's description, from mozilla
- CVE published
- 23 July 2019
- Assigned by
- mozilla
- CVSS
- 8.8 High (CVSS 3.1, from CISA-ADP)
- CWE-843
- Access of Resource Using Incompatible Type ('Type Confusion')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- Exploit-DB published an exploit (EDB-ID 47038).
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 50691).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Exploit-DB: Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type ConfusionEDB-ID 47038, verified by Exploit-DB, 26 June 2019
- Exploit-DB: Mozilla Firefox 67 - Array.pop JIT Type ConfusionEDB-ID 50691, 2 February 2022
Firefox and Thunderbird: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2013-1690Denial-of-Service | Mozilla Firefox and Thunderbird | Patch this weekMetasploit module; EPSS 0.69; verified Exploit-DB entry | 0.69 | ||
| CVE-2019-11708Sandbox Escape | Mozilla Firefox and Thunderbird | Patch this weekEPSS 0.56 | 0.56 | ||
| CVE-2019-17026Type Confusion | Mozilla Firefox and Thunderbird | Patch soon | 0.46 | ||
| CVE-2020-6820Use-After-Free | Mozilla Firefox and Thunderbird | Patch soon | 0.07 | ||
| CVE-2020-6819Use-After-Free | Mozilla Firefox and Thunderbird | Patch soon | 0.03 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org