CVE-2019-11758

EUVD-2019-3428
Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 69.0
mozillafirefox_esr
𝑥
< 68.2
mozillathunderbird
𝑥
< 68.2
canonicalubuntu_linux
16.04
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
thunderbird
bookworm
1:115.12.0-1~deb12u1
fixed
bookworm (security)
1:115.16.0esr-1~deb12u1
fixed
bullseye
1:115.12.0-1~deb11u1
fixed
bullseye (security)
1:128.4.0esr-1~deb11u1
fixed
sid
1:128.4.0esr-1
fixed
trixie
1:128.4.0esr-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
bionic
not-affected
disco
not-affected
eoan
not-affected
trusty
dne
xenial
not-affected
Common Weakness Enumeration
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1536227
https://usn.ubuntu.com/4335-1/
https://www.mozilla.org/security/advisories/mfsa2019-25/
https://www.mozilla.org/security/advisories/mfsa2019-33/
https://www.mozilla.org/security/advisories/mfsa2019-35/
https://bugzilla.mozilla.org/show_bug.cgi?id=1536227
https://usn.ubuntu.com/4335-1/
https://www.mozilla.org/security/advisories/mfsa2019-25/
https://www.mozilla.org/security/advisories/mfsa2019-33/
https://www.mozilla.org/security/advisories/mfsa2019-35/