Vulnerability CVE-2019-11709: Information

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-11709
Published: July 23, 2019
Modified: April 18, 2022
Error type identifier: CWE-787

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus68.0-alt1126.0.1-alt1ALT-PU-2019-2301-1234573Fixed
firefoxp1068.0-alt1118.0.2-alt0.p10.1ALT-PU-2019-2301-1234573Fixed
firefoxp968.0.1-alt0.p9.1105.0.1-alt0.c9.1ALT-PU-2019-2479-1235125Fixed
firefoxp868.0.1-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2019-2938-1236175Fixed
firefoxc10f168.0-alt1112.0.2-alt0.p10.1ALT-PU-2019-2301-1234573Fixed
firefoxc9f268.0.1-alt0.p9.1105.0.1-alt0.c9.1ALT-PU-2019-2479-1235125Fixed
firefoxc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2317-1234651Fixed
firefoxp1168.0-alt1126.0.1-alt1ALT-PU-2019-2301-1234573Fixed
firefox-esrsisyphus60.8.0-alt1115.11.0-alt1ALT-PU-2019-2231-1234195Fixed
firefox-esrp1060.8.0-alt1115.11.0-alt1ALT-PU-2019-2231-1234195Fixed
firefox-esrp960.8.0-alt1102.11.0-alt0.c9.1ALT-PU-2019-2233-1234196Fixed
firefox-esrp860.8.0-alt0.M80P.168.4.1-alt0.M80P.1ALT-PU-2019-2243-1234197Fixed
firefox-esrc10f160.8.0-alt1115.9.1-alt0.c10.1ALT-PU-2019-2231-1234195Fixed
firefox-esrc9f260.8.0-alt1102.12.0-alt0.c9.1ALT-PU-2019-2233-1234196Fixed
firefox-esrp1160.8.0-alt1115.11.0-alt1ALT-PU-2019-2231-1234195Fixed
thunderbirdsisyphus60.8.0-alt1115.9.0-alt1ALT-PU-2019-2249-1234350Fixed
thunderbirdp1060.8.0-alt1115.9.0-alt1ALT-PU-2019-2249-1234350Fixed
thunderbirdp960.8.0-alt1102.11.0-alt0.c9.1ALT-PU-2019-2259-1234411Fixed
thunderbirdp860.8.0-alt0.M80P.160.8.0-alt0.M80P.1ALT-PU-2019-2277-1234413Fixed
thunderbirdc10f160.8.0-alt1115.9.0-alt0.c10.1ALT-PU-2019-2249-1234350Fixed
thunderbirdc9f260.8.0-alt1102.11.0-alt0.c9.1ALT-PU-2019-2259-1234411Fixed
thunderbirdc760.8.0-alt0.M70C.160.8.0-alt0.M70C.1ALT-PU-2019-2345-1234994Fixed
thunderbirdp1160.8.0-alt1115.9.0-alt1ALT-PU-2019-2249-1234350Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1547266%2C1540759%2C1548822%2C1550498%2C1515052%2C1539219%2C1547757%2C1550498%2C1533522
  • Issue Tracking
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-22/
  • Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-23/
  • Vendor Advisory
openSUSE-SU-2019:1811
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:1813
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20190802 [SECURITY] [DLA 1870-1] thunderbird security update
  • Mailing List
  • Third Party Advisory
[debian-lts-announce] 20190802 [SECURITY] [DLA 1869-1] firefox-esr security update
  • Mailing List
  • Third Party Advisory
GLSA-201908-12
  • Third Party Advisory
GLSA-201908-20
  • Third Party Advisory
openSUSE-SU-2019:1990
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:2249
  • Mailing List
  • Third Party Advisory
openSUSE-SU-2019:2248
  • Mailing List
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      68.0
      cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
      End excliding
      60.8.0
      cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
      End excliding
      60.8.0

      Configuration 2

      cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
      cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top