Type Confusion in Firefox ESR and Mozilla Firefox - CVE-2019-11707

Vulnerability identifier: #VU18824

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11707

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error when manipulating JavaScript objects due to issues in Array.pop. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: this vulnerability is being actively exploited in the wild along with SB2019062002 (CVE-2019-11708).

Firefox ESR
Mozilla Firefox
Arch Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Slackware Linux
Opensuse
Fedora
firefox (Ubuntu package)
firefox-esr (Debian package)
firefox-esr (Alpine package)
thunderbird (Debian package)
gjs
mozjs60
firefox
mozjs68 (Alpine package)
SUSE Package Hub for SUSE Linux Enterprise
Mozilla Thunderbird

Install updates from vendor's website.

Firefox ESR - update to 60.7.1
Mozilla Firefox - update to 67.0.3
firefox (Ubuntu package) - addressed in versions 67.0.3+build1-0ubuntu0.16.04.1, 67.0.3+build1-0ubuntu0.18.04.1, 67.0.3+build1-0ubuntu0.18.10.1, 67.0.3+build1-0ubuntu0.19.04.1
firefox-esr (Debian package) - update to 60.7.1esr-1~deb9u1
Mozilla Thunderbird - update to 60.7.2
firefox-esr (Alpine package) - addressed in versions 60.7.1-r0, 60.7.2-r0
thunderbird (Debian package) - update to 1:60.7.2-1~deb9u1
gjs - update to 1.56.2-4.fc30
mozjs60 - update to 60.7.2-1.fc30
firefox - addressed in versions 67.0.3-1.fc29, 67.0.3-1.fc30
mozjs68 (Alpine package) - update to 68.4.1-r0

• Exploit #7819 - Mozilla Firefox 67 - Array.pop JIT Type Confusion (May 13, 2022)
• Exploit #2172 - CVE-2019-11707 (Exploit code for CVE-2019-11707 on Firefox 66.0.3 running on Ubuntu ) (March 18, 2020)

• https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/
• https://twitter.com/5aelo/status/1141273394723414016
• https://twitter.com/SecurityGuyPhil/status/1141466335592869888

• Remote code execution in Mozilla Firefox and Firefox ESR
• Arch Linux update for firefox-developer-edition
• Arch Linux update for firefox
• Slackware Linux update for mozilla-firefox
• Debian update for firefox-esr
• Ubuntu update for Firefox
• Multiple vulnerabilities in Mozilla Thunderbird
• Slackware Linux update for mozilla-thunderbird
• OpenSUSE Linux update for MozillaThunderbird
• OpenSUSE Linux update for MozillaFirefox
• OpenSUSE Linux update for MozillaThunderbird
• Debian update for thunderbird
• OpenSUSE Linux update for MozillaThunderbird
• Red Hat update for thunderbird
• Red Hat update for thunderbird
• Red Hat update for firefox
• Red Hat update for firefox
• Red Hat update for firefox
• Red Hat update for thunderbird
• Type Confusion in mozjs68 (Alpine package)
• Type Confusion in firefox-esr (Alpine package)
• Fedora 30 update for firefox
• Fedora 29 update for firefox
• Fedora 30 update for gjs, mozjs60