CVE-2019-11707

CVE Details

Release Date:	2019-07-23
Impact:	Critical	What is this?

Description

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

See more information about CVE-2019-11707 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	8.8
Vector String:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Version:	3.0
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	High
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (firefox)	ELSA-2019-1604	2019-06-25
Oracle Linux version 6 (thunderbird)	ELSA-2019-1624	2019-06-27
Oracle Linux version 7 (firefox)	ELSA-2019-1603	2019-06-26
Oracle Linux version 7 (thunderbird)	ELSA-2019-1626	2019-06-27
Oracle Linux version 8 (firefox)	ELSA-2019-1696	2019-07-30
Oracle Linux version 8 (thunderbird)	ELSA-2019-1623	2019-07-30