Risk | High |
Patch available | YES |
Number of vulnerabilities | 21 |
CVE-ID | CVE-2019-9790 CVE-2019-9791 CVE-2019-9792 CVE-2019-9793 CVE-2019-9794 CVE-2019-9795 CVE-2019-9796 CVE-2019-9797 CVE-2019-9798 CVE-2019-9799 CVE-2019-9801 CVE-2019-9802 CVE-2019-9803 CVE-2019-9804 CVE-2019-9805 CVE-2019-9806 CVE-2019-9807 CVE-2019-9809 CVE-2019-9808 CVE-2019-9789 CVE-2019-9788 |
CWE-ID | CWE-416 CWE-843 CWE-119 CWE-78 CWE-264 CWE-427 CWE-125 CWE-399 |
Exploitation vector | Network |
Public exploit |
Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. |
Vulnerable software Subscribe |
Mozilla Firefox Client/Desktop applications / Web browsers Firefox ESR Client/Desktop applications / Web browsers |
Vendor | Mozilla |
Security Bulletin
This security bulletin contains information about 21 vulnerabilities.
EUVDB-ID: #VU18029
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9790
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. A remote attacker can trick the victim to visit a specially crafted web page, trigger use-after-free error and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1525145
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18030
Risk: High
CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-9791
CWE-ID:
CWE-843 - Type confusion
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a type confusion error within the type inference system. The system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). A remote attacker can trick the victim to visit a specially crafted web page, trigger type confusion error and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1530958
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU18031
Risk: High
CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]
CVE-ID: CVE-2019-9792
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error within the IonMonkey just-in-time (JIT) compiler that leaks an internal JS_OPTIMIZED_OUT
magic value to the running script during a bailout. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1532599
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
EUVDB-ID: #VU18032
Risk: High
CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9793
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to missing boundary checks for strings, arrays or typed arrays when the default Spectre mitigations have been disabled. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system but requires the user to specifically disable Spectre mitigations.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
Firefox ESR: before 60.6.0
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1528829
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18033
Risk: High
CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9794
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to improper validation of command line arguments within the URI handler when opening documents with Firefox. A remote attacker can trick the victim to open a file with a specially crafted filename and execute arbitrary commands on the system.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1530103
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18034
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9795
CWE-ID:
CWE-843 - Type confusion
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a type confusion error within the IonMonkey just-in-time (JIT) compiler. A remote attacker can trick the victim to visit a specially crafted web page, trigger type confusion error and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1514682
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18035
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9796
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the SMIL animation controller. A remote attacker can trick the victim to visit a specially crafted web page, trigger use-after-free error and execute arbitrary code on the system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 60.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1531277
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18036
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9797
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to incorrect implementation of the cross-origin policy when reading images using createImageBitmap
. A remote attacker can trick the victim into visiting a specially crafted web page and gain access to images opened in other browser tabs.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1528909
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18037
Risk: Low
CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9798
CWE-ID:
CWE-427 - Uncontrolled Search Path Element
Exploit availability: No
DescriptionThe vulnerability allows a malicious application to escalate privileges on the system.
The vulnerability exists due to Firefox on Android allows loading of a library from APITRACE_LIB
path that is writable by default by all users and applications. A malicious third-party application can place a malicious library and perform MitM attack.
Note: this vulnerability affects Android installation only.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1527534
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18038
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9799
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when reading IPC messages. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read memory from the parent process under certain conditions.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 62.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1505678
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18039
Risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9801
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to Firefox accepts any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. A remote attacker can trick the victim to open a specially crafted link and execute an arbitrary application on the system with privileges of the current user.
Note: this vulnerability affects Windows operating system only.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1527717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18040
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9802
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to improper handling of FTP downloads. A remote attacker can trick the victim to open a specially crafted web page and initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1415508
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18041
Risk: Medium
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9803
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform man-in-the-middle attack.
The vulnerability exists due to incorrect enforcement of Upgrade-Insecure-Requests (UIR) for same-origin navigation allowing the browser to navigate to HTTP URL instead of HTTPS. A remote attacker can perform man-in-the-middle (MitM) attack and gain access to sensitive information.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1515863
http://bugzilla.mozilla.org/show_bug.cgi?id=1437009
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18042
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9804
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper validation data passed via the 'Copy as cURL' functionality in Firefox Developer Tools on macOS. A remote attacker can trick the victim to copy a specially crafted link and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: the vulnerability affects macOS users only.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1518026
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18043
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9805
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to perform a denial of service attack.
The vulnerability exists due to a boundary condition within the Prio library . A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger out-of-bounds read error and crash the application.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1521360
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18044
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9806
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to browser does not limit the number of authorization prompts for FTP transactions, displaying unlimited number of modal prompts that cannot be dismissed. A remote attacker can trick the victim to connect to a malicious crafted FTP server and perform denial of service attack against the browser.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1525267
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18045
Risk: Low
CVSSv3.1: 3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9807
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a phishing attack.
The vulnerability exists due to the way text messages produced by the FTP server are handled by the browser when a page reload is initiated. A remote attacker can create a modal alert message with arbitrary text as content and perform phishing attack.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1362050
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18046
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9809
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect processing of modal alert messages sent by FTP server. A remote attacker can trick the victim to connect to a malicious FTP server and trigger a series of modal alert messages for these resources through invalid credentials or locations, resulting in denial of service attackInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1282430
http://bugzilla.mozilla.org/show_bug.cgi?id=1523249
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18047
Risk: Low
CVSSv3.1: 3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9808
CWE-ID:
CWE-399 - Resource Management Errors
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a phishing attack.
The vulnerability exists due to incorrect handling of WebRTC permissions requests for documents with data: or blob: URLs, resulting in "Unknown origin" notification. A remote attacker can abuse this behavior and trick the victim into granting permissions to a malicious website.
Install updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/show_bug.cgi?id=1434634
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18049
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9789
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to multiple boundary errors when processing HTML content. A remote attacker trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/buglist.cgi?bug_id=1518001%2C1521304%2C1521214%2C1506665%2C1516834%2C15...
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU18048
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-9788
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to multiple boundary errors when processing HTML content. A remote attacker trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMozilla Firefox: 61.0 - 65.0.2
External linkshttp://www.mozilla.org/en-US/security/advisories/mfsa2019-07/
http://bugzilla.mozilla.org/buglist.cgi?bug_id=1520483%2C1522987%2C1528199%2C1519337%2C1525549%2C15...
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.