Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-44B6DFBF-4EF7-4D52-AD52-2B1B05D81272 (CVE-2019-9818): mozilla -- multiple vulnerabilities

Free InsightVM Trial No Credit Card Necessary
2024 Attack Intel Report Latest research by Rapid7 Labs
Back to Search

FreeBSD: VID-44B6DFBF-4EF7-4D52-AD52-2B1B05D81272 (CVE-2019-9818): mozilla -- multiple vulnerabilities

Severity
5
CVSS
(AV:N/AC:H/Au:N/C:P/I:P/A:P)
Published
05/21/2019
Created
05/25/2019
Added
05/23/2019
Modified
03/05/2020

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From VID-44B6DFBF-4EF7-4D52-AD52-2B1B05D81272:

Mozilla Foundation reports:

CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

CVE-2019-9816: Type confusion with object groups and UnboxedObjects

CVE-2019-9817: Stealing of cross-domain images using canvas

CVE-2019-9818: Use-after-free in crash generation server

CVE-2019-9819: Compartment mismatch with fetch API

CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

CVE-2019-9821: Use-after-free in AssertWorkerThread

CVE-2019-11691: Use-after-free in XMLHttpRequest

CVE-2019-11692: Use-after-free removing listeners in the event listener manager

CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

CVE-2019-7317: Use-after-free in png_image_free of libpng library

CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

CVE-2019-11695: Custom cursor can render over user interface outside of web content

CVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts

CVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions

CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

CVE-2019-11700: res: protocol can be used to open known local files

CVE-2019-11699: Incorrect domain name highlighting during page navigation

CVE-2019-11701: webcal: protocol default handler loads vulnerable web page

CVE-2019-9814: Memory safety bugs fixed in Firefox 67

CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

Solution(s)

  • freebsd-upgrade-package-firefox
  • freebsd-upgrade-package-firefox-esr
  • freebsd-upgrade-package-libxul
  • freebsd-upgrade-package-linux-firefox
  • freebsd-upgrade-package-linux-seamonkey
  • freebsd-upgrade-package-linux-thunderbird
  • freebsd-upgrade-package-seamonkey
  • freebsd-upgrade-package-thunderbird
  • freebsd-upgrade-package-waterfox

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;