Puansız
Frame poisoning in the Layout component
Mozilla Firefox
Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44.
8.8Yüksek
KEV
CVE-2019-11707Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Aktif olarak istismar ediliyor — Mozilla Firefox and Thunderbird Type Confusion Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 23.05.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 13.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-11707
Açıklama
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
Zayıflık türü (CWE):
CWE-843
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Mozilla | Firefox | unspecified – < 67.0.3 | |
| Mozilla | Firefox ESR | unspecified – < 60.7.1 | |
| Mozilla | Thunderbird | unspecified – < 60.7.2 |
Kaynaklar ve yamalar
- https://www.mozilla.org/security/advisories/mfsa2019-20/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-18/ Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 Issue TrackingVendor Advisory
- GLSA-201908-12 vendor-advisoryThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707 US Government Resource
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*< 60.7.1cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 67.0.3cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*< 60.7.2