CVE-2019-11707 Mozilla Firefox and Thunderbird Type Confusion
A type confusion flaw in Firefox and Thunderbird allows attackers to cause crashes and potentially execute arbitrary code via crafted JavaScript.
- Exploited in the wild
- Since 23 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11707?
CVE-2019-11707 is a high-severity memory corruption vulnerability in Mozilla Firefox, published on 23 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
Weakness: CWE-843
Which versions are affected by CVE-2019-11707?
It affects 2 products.
Linux distribution packages (19)
MozillaFirefox SUSE:Enterprise Storage 4 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Module for Desktop Applications 15 | All versions | 60.7.1-3.45.1 |
MozillaFirefox SUSE:Linux Enterprise Module for Desktop Applications 15 SP1 | All versions | 60.7.1-3.45.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP3 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP4 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12-LTSS | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 60.7.1-109.77.1 |
MozillaFirefox SUSE:OpenStack Cloud 7 | All versions | 60.7.1-109.77.1 |
MozillaFirefox openSUSE:Leap 15.0 | All versions | 60.7.2-lp150.3.59.1 |
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2019-11707?
Upgrade to a fixed version. US federal agencies must fix it by 13 Jun 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2019-11707 being exploited?
Yes. Attackers have exploited CVE-2019-11707 in the wild since at least 23 May 2022.
Public exploit code: 2 Exploit-DB entries and 4 proofs of concept on GitHub.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as ALPINE-CVE-2019-11707, DEBIAN-CVE-2019-11707, DLA-1829-1, DSA-4466-1, GHSA-8ffr-q7j8-h445, MGASA-2019-0198 and 5 more.