8.8Hoch
Incorrect boundary conditions in the Layout: Block and Inline component
Mozilla Firefox
Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.
8.8Hoch
KEV
CVE-2019-11707Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Bekannt ausgenutzt — Mozilla Firefox and Thunderbird Type Confusion Vulnerability
CISA hat am 23.05.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 13.06.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-11707
Beschreibung
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
Schwachstellentyp (CWE):
CWE-843
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Mozilla | Firefox | unspecified – < 67.0.3 | |
| Mozilla | Firefox ESR | unspecified – < 60.7.1 | |
| Mozilla | Thunderbird | unspecified – < 60.7.2 |
Referenzen und Patches
- https://www.mozilla.org/security/advisories/mfsa2019-20/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-18/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 Issue TrackingVendor Advisory
- GLSA-201908-12 vendor-advisoryThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707 US Government Resource
CPE-Treffer (NVD) (3)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*< 60.7.1cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 67.0.3cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*< 60.7.2