The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefox-esr | Nov 8, 2019 | Jul 23, 2019 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-thunderbirdamazon-linux-ami-2-upgrade-thunderbird-debuginfo | Apr 27, 2020 | Jul 23, 2019 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jul 23, 2019 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-firefox-debugsourcecentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfocentos-upgrade-thunderbird-debugsource | May 31, 2019 | May 21, 2019 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-thunderbird | May 23, 2019 | May 23, 2019 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-waterfoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | May 23, 2019 | May 22, 2019 | |
| Mfsa2019 13 | mozilla-firefox-upgrade-67_0 | May 22, 2019 | May 21, 2019 | |
| Mfsa2019 14 | mozilla-firefox-esr-upgrade-60_7 | May 22, 2019 | May 21, 2019 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-60_7 | May 23, 2019 | May 21, 2019 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-mail-thunderbird-60-7-0-11-4-10-0-1-2-0oracle-solaris-11-4-upgrade-mail-thunderbird-plugin-thunderbird-lightning-60-7-0-11-4-10-0-1-2-0oracle-solaris-11-4-upgrade-web-browser-firefox-60-7-0-11-4-10-0-1-2-0oracle-solaris-11-4-upgrade-web-data-firefox-bookmarks-60-7-0-11-4-10-0-1-2-0 | Jun 26, 2019 | Jun 26, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | May 24, 2019 | May 22, 2019 |
| Redhat_linux | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-firefox-debugsourceredhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginforedhat-upgrade-thunderbird-debugsource | May 24, 2019 | May 23, 2019 | |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-branding-upstreamsuse-upgrade-mozillafirefox-buildsymbolssuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | May 31, 2019 | May 21, 2019 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | May 22, 2019 | May 21, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub