critical9.8Public exploit code
CVE-2019-9791
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR2019-03-26 · dos · multiple · Verified
Impact
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 60.6.0 before 66.0 |
| Mozilla | Thunderbird | before 60.6.0 |
| Redhat | Enterprise Linux | Version 8.0 |
| Redhat | Enterprise Linux Eus | Versions 8.1, 8.2, 8.4 |
| Redhat | Enterprise Linux Server Aus | Versions 8.2, 8.4 |
| Redhat | Enterprise Linux Server Tus | Versions 8.2, 8.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2019:0966
- https://access.redhat.com/errata/RHSA-2019:1144
- https://bugzilla.mozilla.org/show_bug.cgi?id=1530958
- https://www.mozilla.org/security/advisories/mfsa2019-07/
- https://www.mozilla.org/security/advisories/mfsa2019-08/
- https://www.mozilla.org/security/advisories/mfsa2019-11/
- https://access.redhat.com/errata/RHSA-2019:0966
- https://access.redhat.com/errata/RHSA-2019:1144
- https://bugzilla.mozilla.org/show_bug.cgi?id=1530958
- https://www.mozilla.org/security/advisories/mfsa2019-07/
- https://www.mozilla.org/security/advisories/mfsa2019-08/
- https://www.mozilla.org/security/advisories/mfsa2019-11/