CVE-2019-11707
Published 2019-07-23 · Updated 2026-06-17 · Source security@mozilla.org
Summary
CVE-2019-11707 is a high-severity (CVSS 8.8) vulnerability in Mozilla Firefox and Thunderbird. CISA added it to the Known Exploited Vulnerabilities catalog on May 23, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 13, 2022. CISA does not currently list it as used in ransomware campaigns. Mozilla has 13 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.
All 13 known-exploited Mozilla vulnerabilities →Description
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Mozilla — Firefox and Thunderbird
Name: Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Date added: 2022-05-23 · Due: 2022-06-13
Required action: Apply updates per vendor instructions.
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
- https://security.gentoo.org/glsa/201908-12
- https://www.mozilla.org/security/advisories/mfsa2019-18/
- https://www.mozilla.org/security/advisories/mfsa2019-20/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
- https://security.gentoo.org/glsa/201908-12
- https://www.mozilla.org/security/advisories/mfsa2019-18/
- https://www.mozilla.org/security/advisories/mfsa2019-20/