CVE-2019-9800 — Out-of-bounds Write in Mozilla Firefox

CWE-787 — Out-of-bounds WriteCWE-120 — Classic Buffer OverflowCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer14 documents7 sources
Severity
9.8CRITICALNVD
EPSS
0.6%
top 31.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Mozilla FirefoxMozilla Firefox ESRMozilla Thunderbird+3 more
Timeline
PublishedJul 23
Latest updateMay 24

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages12 packages

▶CVEListV5mozilla/firefoxunspecified — 67
▶NVDmozilla/firefox< 67.0
▶CVEListV5mozilla/firefox_esrunspecified — 60.7
▶Ubuntumozilla/firefox< 67.0+build2-0ubuntu0.16.04.1+5

🔴Vulnerability Details

6
GHSA
GHSA-3rp9-w2c5-r4p5: Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60↗2022-05-24
▶
OSV
CVE-2019-9800: Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60↗2019-07-23
▶
OSV
firefox regression↗2019-06-14
▶
OSV
firefox regression↗2019-06-06
▶
OSV
thunderbird vulnerabilities↗2019-05-28
▶

📋Vendor Advisories

6
Ubuntu
Firefox regression↗2019-06-14
▶
Ubuntu
Firefox regression↗2019-06-06
▶
Ubuntu
Thunderbird vulnerabilities↗2019-05-28
▶
Red Hat
Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7↗2019-05-22
▶
Ubuntu
Firefox vulnerabilities↗2019-05-21
▶

💬Community

1
Bugzilla
CVE-2019-9800 Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7↗2019-05-22
▶