high8.8Known exploitedPublic exploit code
CVE-2019-11707
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-23. Federal due date: 2022-06-13.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion2019-06-26 · dos · multiple · Verified
- Mozilla Firefox 67 - Array.pop JIT Type Confusion2022-02-02 · local · windows
Impact
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 60.7.1 before 67.0.3 |
| Mozilla | Thunderbird | before 60.7.2 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
- https://security.gentoo.org/glsa/201908-12
- https://www.mozilla.org/security/advisories/mfsa2019-18/
- https://www.mozilla.org/security/advisories/mfsa2019-20/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
- https://security.gentoo.org/glsa/201908-12
- https://www.mozilla.org/security/advisories/mfsa2019-18/
- https://www.mozilla.org/security/advisories/mfsa2019-20/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707