CVE-2019-9810
published 2019-04-26CVE-2019-9810: Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This…
PriorityP180high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
29.51%
98.0th percentile
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 66.0.1-1 (sid) | firefox 66.0.1-1 (sid) |
| debian | firefox-esr | < firefox 66.0.1-1 (sid) | firefox 66.0.1-1 (sid) |
| mozilla | firefox | < 60.6.1 | 60.6.1 |
| mozilla | firefox | < 66.0.1 | 66.0.1 |
| mozilla | firefox | >= unspecified < 66.0.1 | 66.0.1 |
| mozilla | firefox_esr | >= unspecified < 60.6.1 | 60.6.1 |
| mozilla | thunderbird | < 60.6.1 | 60.6.1 |
| mozilla | thunderbird | >= 0 < 1:60.6.1+build2-0ubuntu0.14.04.1 | 1:60.6.1+build2-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:60.6.1+build2-0ubuntu0.16.04.1 | 1:60.6.1+build2-0ubuntu0.16.04.1 |
| mozilla | thunderbird | >= 0 < 1:60.6.1+build2-0ubuntu0.18.04.1 | 1:60.6.1+build2-0ubuntu0.18.04.1 |
| mozilla | thunderbird | >= unspecified < 60.6.1 | 60.6.1 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit triggers Array.prototype.slice on a subclassed Array (Symbol.species override) to corrupt array length to 0x42424242, indicating IonMonkey JIT alias confusion exploitation in progress. ↗
- →Exploit uses a custom Array subclass overriding Symbol.species to manipulate array length during JIT-compiled slice, a hallmark of CVE-2019-9810 exploitation. Monitor for JS with 'static get [Symbol.species]' returning a constructor that resizes arrays. ↗
- →Exploit chains CVE-2019-9810 with CVE-2019-11708 sandbox escape via 'Prompt:Open' IPC message. Detect frame scripts sending 'Prompt:Open' syncMessages with attacker-controlled URIs. ↗
- →Exploit drops a frame script to disk using OS.File and loads it via Services.mm.loadFrameScript. Monitor for unexpected frame script files written to disk and loaded by Firefox. ↗
- →Exploit abuses Components.utils.import and Cu.Sandbox with system principal to obtain docShell and frame messageManager — a privilege escalation pattern detectable via CSP/sandbox policy violations or privileged JS API access from content. ↗
- →Exploit targets Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1. Detect unpatched versions via user-agent or software inventory. ↗
- →ArrayBuffer corruption uses magic value 0xfff8800000010000 written at offset +0x28 from ArrayBuffer object address. This byte pattern in heap memory is a strong indicator of active exploitation. ↗
- ·The exploit offsets (e.g., XulsAutomationPrefIsSet = 0x051c0f13, XuldisabledForTest = 0x05171cd8) are hardcoded for a specific xul.dll build and will not be reliable across different Firefox versions or builds. ↗
- ·Thunderbird exploitation is generally not possible via email because scripting is disabled when reading mail; risk is limited to browser or browser-like contexts. ↗
- ·The full-chain exploit (EDB-47752) targets Windows 10 x64 specifically; exploitation on other platforms may require different heap layout and offset adjustments. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vulncheck8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_ubuntu5.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j339-cxg8-wjf2: Incorrect alias information in IonMonkey JIT compiler for Array
ghsa_unreviewed·2022-05-24
CVE-2019-9810 [HIGH] CWE-119 GHSA-j339-cxg8-wjf2: Incorrect alias information in IonMonkey JIT compiler for Array
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
OSV
CVE-2019-9810: Incorrect alias information in IonMonkey JIT compiler for Array
osv·2019-04-26·CVSS 8.8
CVE-2019-9810 [HIGH] CVE-2019-9810: Incorrect alias information in IonMonkey JIT compiler for Array
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
OSV
thunderbird vulnerabilities
osv·2019-03-28·CVSS 5.9
CVE-2018-18506 [MEDIUM] thunderbird vulnerabilities
thunderbird vulnerabilities
It was discovered that Thunderbird allowed PAC files to specify that
requests to localhost are sent through the proxy to another server. If
proxy auto-detection is enabled, an attacker could potentially exploit
this to conduct attacks on local services and tools. (CVE-2018-18506)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
or execute arbitrary code. (CVE-2019-9788, CVE-2019-9790, CVE-2019-9791,
CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9810, CVE-2019-9813)
A mechanism was discovered that removes some bounds checking for string,
array, or typed array accesses if Spectre mitiga
VulnCheck
Mozilla Firefox Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2019·CVSS 8.8
CVE-2019-9810 [HIGH] Mozilla Firefox Improper Restriction of Operations within the Bounds of a Memory Buffer
Mozilla Firefox Improper Restriction of Operations within the Bounds of a Memory Buffer
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
Affected: Mozilla Firefox
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.zimperium.com/blog/the-case-of-cloud9-chrome-botnet/
Exploit PoC: https://vulncheck.com/xdb/2b660aa21260; https://vulncheck.com/xdb/cc8b9d0afe8a
Project0
Project Zero RCA: CVE-2019-11707: IonMonkey Type Confusion in Array.Pop
project_zero·CVSS 8.8
CVE-2019-11707 [HIGH] Project Zero RCA: CVE-2019-11707: IonMonkey Type Confusion in Array.Pop
# CVE-2019-11707: IonMonkey Type Confusion in Array.Pop
*Samuel Groß, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-07-27)*
## The Basics
**Disclosure or Patch Date:** 18 June 2019
**Product:** Mozilla Firefox
**Advisory:** https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/
**Affected Versions:** Firefox 67.0.2, likely earlier versions
**First Patched Version:** Firefox 67.0.3 and Firefox ESR 60.7.1
**Issue/Bug Report:**
* Project Zero issue: https://bugs.chromium.org/p/project-zero/issues/detail?id=1820
* Firefox issue: https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
**Patch CL:** https://hg.mozilla.org/releases/mozilla-beta/rev/109cefe117fbdd1764097e06796960082f4fee4e
**Bug-Introducing CL:** Unkno
Project0
Project Zero RCA: CVE-2019-17026: Firefox Type Confusion in IonMonkey
project_zero·CVSS 8.8
CVE-2019-17026 [HIGH] Project Zero RCA: CVE-2019-17026: Firefox Type Confusion in IonMonkey
# CVE-2019-17026: Firefox Type Confusion in IonMonkey
*Samuel Groß, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-08-05)*
## The Basics
**Disclosure or Patch Date:** 8 January 2020
**Product:** Mozilla Firefox
**Advisory:** https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/
**Affected Versions:**
**First Patched Version:** Firefox 72.0.1 and Firefox ESR 68.4.1
**Issue/Bug Report:** https://bugzilla.mozilla.org/show_bug.cgi?id=1607443
**Patch CL:** https://hg.mozilla.org/mozilla-central/rev/d6e40de88f3defdc12ef27e64ca73e120b1f10e2
**Bug-Introducing CL:**
* Adding StoreElementHole: https://hg.mozilla.org/mozilla-central/rev/550a780f73aeb23ea958cab93de141376aa12f3a
* Adding FallibleStoreElement: https://hg.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2019-03-28·CVSS 5.9
CVE-2018-18506 [MEDIUM] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
It was discovered that Thunderbird allowed PAC files to specify that
requests to localhost are sent through the proxy to another server. If
proxy auto-detection is enabled, an attacker could potentially exploit
this to conduct attacks on local services and tools. (CVE-2018-18506)
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
or execute arbitrary code. (CVE-2019-9788, CVE-2019-9790, CVE-2019-9791,
CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9810, CVE-2019-9813)
A mechanism was discovered that removes some bounds c
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2019-03-25
CVE-2019-9810 Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Two security issues were discovered in the JavaScript engine in Firefox.
If a user were tricked in to opening a specially crafted website, an
attacker could exploit this by causing a denial of service, or executing
arbitrary code.
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Red Hat
Mozilla: IonMonkey MArraySlice has incorrect alias information
vendor_redhat·2019-03-22·CVSS 8.8
CVE-2019-9810 [HIGH] CWE-119 Mozilla: IonMonkey MArraySlice has incorrect alias information
Mozilla: IonMonkey MArraySlice has incorrect alias information
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
Statement: In general, this flaw be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
Debian
CVE-2019-9810: firefox - Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice ...
vendor_debian·2019·CVSS 8.8
CVE-2019-9810 [HIGH] CVE-2019-9810: firefox - Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice ...
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
Scope: local
sid: resolved (fixed in 66.0.1-1)
No detection rules found.
Exploit-DB
Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack
exploitdb·2019-12-07
CVE-2019-9810 Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack
Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack
---
// Axel '0vercl0k' Souchet - November 19 2019
// EDB Note: Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47752.zip
// 0:000> ? xul!sAutomationPrefIsSet - xul
// Evaluate expression: 85724947 = 00000000`051c0f13
const XulsAutomationPrefIsSet = 0x051c0f13n;
// 0:000> ? xul!disabledForTest - xul
// Evaluate expression: 85400792 = 00000000`05171cd8
const XuldisabledForTest = 0x05171cd8n;
const Debug = false;
const dbg = p => {
if(Debug == false) {
return;
}
print(`Debug: ${p}`);
};
const ArraySize = 0x5;
const WantedArraySize = 0x42424242;
let arr = null;
let Trigger = false;
const Spray = [];
function f(Special, Idx, Value) {
arr[Idx] = 0x41414141;
Special.slice();
arr[I
Exploit-DB
Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow
exploitdb·2019-03-26
CVE-2019-9810 Firefox < 66.0.1 - 'Array.prototype.slice' Buffer Overflow
Firefox
let size = 64;
garr = [];
j = 0;
function gc(){
var tmp = [];
for(let i = 0;i
Bugzilla
Windows sandbox: renderer processes can open each and unrelated Chromium processes
bugzilla·2019-05-24
[MEDIUM] Windows sandbox: renderer processes can open each and unrelated Chromium processes
Windows sandbox: renderer processes can open each and unrelated Chromium processes
Chromium uses the following code to prevent access between renderers, and from renderers to other low integrity processes: https://cs.chromium.org/chromium/src/services/service_manager/sandbox/win/sandbox_win.cc?l=430
```
result = policy->SetTokenLevel(sandbox::USER_RESTRICTED_SAME_ACCESS,
sandbox::USER_LOCKDOWN);
if (result != sandbox::SBOX_ALL_OK)
return result;
// Prevents the renderers from manipulating low-integrity processes.
result = policy->SetDelayedIntegrityLevel(sandbox::INTEGRITY_LEVEL_UNTRUSTED);
```
In SandboxBroker::SetSecurityLevelForContentProcess of Firefox with aSandboxLevel ) to check if the result is non-zero. The steps for doing so are as follows (on Windows 10):
```
bp kernel32!Rea
Bugzilla
CVE-2019-9810 Mozilla: IonMonkey MArraySlice has incorrect alias information
bugzilla·2019-03-24·CVSS 8.8
CVE-2019-9810 [HIGH] CVE-2019-9810 Mozilla: IonMonkey MArraySlice has incorrect alias information
CVE-2019-9810 Mozilla: IonMonkey MArraySlice has incorrect alias information
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-10/#CVE-2019-9810
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: Richard Zhu and Amat Cama via Trend Micro's Zero Day Initiative
---
Statement:
In general, this flaw be exploited through email in the Thunderbird product because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2019:0671 https://access.redhat.com/erra
http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.htmlhttps://access.redhat.com/errata/RHSA-2019:0966https://access.redhat.com/errata/RHSA-2019:1144https://bugzilla.mozilla.org/show_bug.cgi?id=1537924https://www.mozilla.org/security/advisories/mfsa2019-09/https://www.mozilla.org/security/advisories/mfsa2019-10/https://www.mozilla.org/security/advisories/mfsa2019-12/http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.htmlhttps://access.redhat.com/errata/RHSA-2019:0966https://access.redhat.com/errata/RHSA-2019:1144https://bugzilla.mozilla.org/show_bug.cgi?id=1537924https://www.mozilla.org/security/advisories/mfsa2019-09/https://www.mozilla.org/security/advisories/mfsa2019-10/https://www.mozilla.org/security/advisories/mfsa2019-12/
2019-04-26
Published
Exploited in the wild