Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefoxUpgrade firefox-esr | Aug 22, 2024 | Jan 8, 2020 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Apr 27, 2020 | Jan 8, 2020 |
| Centos_linux | — | Upgrade thunderbirdUpgrade firefoxUpgrade firefox-debuginfoUpgrade firefox-debugsourceUpgrade thunderbird-debugsourceUpgrade thunderbird-debuginfo | Oct 25, 2019 | Oct 23, 2019 |
| Mfsa2019 25 | — | Upgrade to Mozilla Firefox version 69.0 | Oct 23, 2019 | Sep 3, 2019 |
| Mfsa2019 33 | — | Upgrade to Mozilla Firefox ESR version 68.2 | Oct 23, 2019 | Oct 22, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.2 | Oct 25, 2019 | Oct 22, 2019 |
| Oracle Solaris | — | Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4 | Nov 20, 2019 | Nov 20, 2019 |
| Oracle_linux | — | Upgrade firefoxUpgrade thunderbird | Oct 30, 2019 | Oct 22, 2019 |
| Redhat_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debugsourceNo solution existsUpgrade firefox-debuginfoUpgrade firefox | Oct 25, 2019 | Oct 23, 2019 |
| Suse | — | Upgrade mozilla-nspr-develUpgrade firefox-libffi7Upgrade mozillathunderbird-translations-otherUpgrade mozillafirefox-buildsymbolsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozillafirefox-branding-upstreamUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-dataUpgrade libfirefox-gthread-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-libcairo2Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-langUpgrade mozillafirefoxUpgrade libsoftokn3-32bitUpgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libatk-1_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-libffi4Upgrade firefox-libcairo-gobject2Upgrade libfirefox-gio-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade firefox-atk-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-ximUpgrade firefox-glib2-langUpgrade firefox-esr-branding-openSUSEUpgrade mozilla-nss-develUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefox-branding-sleUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nspr-32bitUpgrade mozillathunderbird-translations-commonUpgrade mozillafirefox-translations-commonUpgrade mozillafirefox-develUpgrade libfreebl3Upgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-inuktitutUpgrade MozillaFirefox-branding-openSUSEUpgrade libsoftokn3Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nsprUpgrade mozillathunderbirdUpgrade firefox-glib2-toolsUpgrade libfreebl3-32bitUpgrade firefox-libpango-1_0-0 | Nov 1, 2019 | Oct 29, 2019 |
| Ubuntu | — | Upgrade thunderbird | Nov 27, 2019 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub