Rapid7 Vulnerability & Exploit Database

FreeBSD: (Multiple Advisories) (CVE-2019-11708): Mozilla -- multiple vulnerabilities

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

FreeBSD: (Multiple Advisories) (CVE-2019-11708): Mozilla -- multiple vulnerabilities

Severity
10
CVSS
(AV:N/AC:L/Au:N/C:C/I:C/A:C)
Published
06/20/2019
Created
06/25/2019
Added
06/21/2019
Modified
05/24/2022

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From VID-49BEB00F-A6E1-4A42-93DF-9CB14B4C2BEE:

Mozilla Foundation reports:

CVE-2019-11707: Type confusion in Array.pop

A type confusion vulnerability can occur when manipulating

JavaScript objects due to issues in Array.pop. This can allow

for an exploitable crash. We are aware of targeted attacks in

the wild abusing this flaw.

CVE-2019-11708: sandbox escape using Prompt:Open

Insufficient vetting of parameters passed with the

Prompt:Open IPC message between child and parent processes can

result in the non-sandboxed parent process opening web content

chosen by a compromised child process. When combined with

additional vulnerabilities this could result in executing

arbitrary code on the user's computer.

Solution(s)

  • freebsd-upgrade-package-firefox
  • freebsd-upgrade-package-firefox-esr
  • freebsd-upgrade-package-thunderbird
  • freebsd-upgrade-package-waterfox

References

  • CVE-2019-11708
  • USN-4032-1
  • USN-4045-1

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;