Mozilla · Firefox and Thunderbird
CVE-2019-11707
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Qué es
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.
CISA: Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 13 de junio de 2022
Más fallos explotados de Mozilla
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 23 may 2022 | Sandbox Escape | Firefox and Thunderbird | Crítica 10,0 | 56% |
| 28 mar 2022 | Denial-of-Service | Firefox and Thunderbird | Alto 8,8 | 69% |
| 3 nov 2021 | Use-After-Free | Firefox and Thunderbird | Alto 8,1 | 3,0% |
| 3 nov 2021 | Use-After-Free | Firefox and Thunderbird | Alto 8,1 | 7,1% |
| 3 nov 2021 | Type Confusion | Firefox and Thunderbird | Alto 8,8 | 46% |
| 6 oct 2025 | Remote Code Execution | Multiple Products | Crítica 9,8 | 83% |
| 15 oct 2024 | Use-After-Free | Firefox | Crítica 9,8 | 23% |
| 22 jun 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | Alto 7,5 | 87% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.