Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefoxUpgrade firefox-esr | Aug 22, 2024 | Jan 8, 2020 |
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfo | Apr 27, 2020 | Jan 8, 2020 |
| Centos_linux | — | Upgrade firefox-debugsourceUpgrade thunderbird-debugsourceUpgrade firefox-debuginfoUpgrade thunderbird-debuginfoUpgrade firefoxUpgrade thunderbird | Oct 25, 2019 | Oct 23, 2019 |
| Mfsa2019 25 | — | Upgrade to Mozilla Firefox version 69.0 | Oct 23, 2019 | Sep 3, 2019 |
| Mfsa2019 33 | — | Upgrade to Mozilla Firefox ESR version 68.2 | Oct 23, 2019 | Oct 22, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.2 | Oct 25, 2019 | Oct 22, 2019 |
| Oracle Solaris | — | Upgrade mail/thunderbird to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/browser/firefox to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4Upgrade web/data/firefox-bookmarks to version 68.2.0-11.4.15.0.1.4.0 on Solaris 11.4 | Nov 20, 2019 | Nov 20, 2019 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox | Oct 30, 2019 | Oct 22, 2019 |
| Redhat_linux | — | Upgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade firefox-debuginfoNo solution existsUpgrade firefox-debugsourceUpgrade thunderbird-debuginfoUpgrade firefox | Oct 25, 2019 | Oct 23, 2019 |
| Suse | — | Upgrade firefox-libharfbuzz0Upgrade mozilla-nss-certs-32bitUpgrade libsoftokn3Upgrade firefox-glib2-langUpgrade mozillafirefox-translations-otherUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nssUpgrade MozillaFirefox-branding-openSUSEUpgrade mozilla-nss-certsUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefox-branding-sleUpgrade libfreebl3-32bitUpgrade mozilla-nss-develUpgrade mozilla-nsprUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-toolsUpgrade mozillathunderbirdUpgrade mozilla-nss-32bitUpgrade libfreebl3Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozillafirefox-develUpgrade firefox-esr-branding-openSUSEUpgrade firefox-glib2-toolsUpgrade mozilla-nspr-32bitUpgrade mozillafirefox-translations-commonUpgrade mozillathunderbird-translations-commonUpgrade firefox-libpango-1_0-0Upgrade firefox-libcairo-gobject2Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozillafirefox-branding-upstreamUpgrade firefox-atk-langUpgrade libfirefox-gthread-2_0-0Upgrade mozilla-nspr-develUpgrade libfirefox-glib-2_0-0Upgrade firefox-libffi4Upgrade mozillafirefox-buildsymbolsUpgrade firefox-gtk3-dataUpgrade mozillathunderbird-translations-otherUpgrade firefox-libffi7Upgrade libfirefox-gio-2_0-0Upgrade mozillafirefox-branding-sledUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-langUpgrade firefox-libcairo2Upgrade mozillafirefoxUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-libatk-1_0-0Upgrade libsoftokn3-32bit | Nov 1, 2019 | Oct 29, 2019 |
| Ubuntu | — | Upgrade thunderbird | Nov 27, 2019 | Oct 29, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub