CVE-2019-9810

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack2019-12-07 · local · windows_x86-64
• Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow2019-03-26 · dos · multiple

Impact

Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html
• https://access.redhat.com/errata/RHSA-2019:0966
• https://access.redhat.com/errata/RHSA-2019:1144
• https://bugzilla.mozilla.org/show_bug.cgi?id=1537924
• https://www.mozilla.org/security/advisories/mfsa2019-09/
• https://www.mozilla.org/security/advisories/mfsa2019-10/
• https://www.mozilla.org/security/advisories/mfsa2019-12/
• http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html
• https://access.redhat.com/errata/RHSA-2019:0966
• https://access.redhat.com/errata/RHSA-2019:1144
• https://bugzilla.mozilla.org/show_bug.cgi?id=1537924
• https://www.mozilla.org/security/advisories/mfsa2019-09/
• https://www.mozilla.org/security/advisories/mfsa2019-10/
• https://www.mozilla.org/security/advisories/mfsa2019-12/