Published: 23/07/2019 Updated: 15/08/2019

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

It exists that a sandboxed child process could open arbitrary web content in the parent process via the Prompt:Open IPC message. When combined with another vulnerability, an attacker could potentially exploit this to execute arbitrary code.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr
mozilla firefox
mozilla thunderbird

A sandbox escape was discovered in Firefox ...

Several security issues were fixed in Thunderbird ...

A sandbox escape was found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code if combined with additional vulnerabilities For the stable distribution (stretch), this problem has been fixed in version 6072esr-1~deb9u1 We recommend that you upgrade your firefox-esr packages For the detailed secu ...

Multiple security issues have been found in Thunderbird which may lead to the execution of arbitrary code if malformed email messages are read For the stable distribution (stretch), these problems have been fixed in version 1:6072-1~deb9u1 We recommend that you upgrade your thunderbird packages For the detailed security status of thunderbird p ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...

libical: Heap buffer over read in icalparserc parser_get_next_char (CVE-2019-11703) libical: Type confusion in icaltimezone_get_vtimezone_properties function in icalpropertyc (CVE-2019-11706) Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708) libical: Stack buffer overflow in icalrecur_add_bydayrules in icalrecurc (CVE-2019-11705) libica ...

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer ...

Mozilla Foundation Security Advisory 2019-19 Security vulnerabilities fixed in Firefox 6704 and Firefox ESR 6072 Announced June 20, 2019 Impact high Products Firefox, Firefox ESR Fixed in Firefox 67 ...

Mozilla Foundation Security Advisory 2019-20 Security vulnerabilities fixed in Thunderbird 6072 Announced June 20, 2019 Impact high Products Thunderbird Fixed in Thunderbird 6072 ...

// Axel '0vercl0k' Souchet - November 19 2019 // EDB Note: Download ~ githubcom/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47752zip // 0:000> ? xul!sAutomationPrefIsSet - xul // Evaluate expression: 85724947 = 00000000`051c0f13 const XulsAutomationPrefIsSet = 0x051c0f13n; // 0:000> ? xul!disabledForTest - xul ...

Mozilla Firefox version 67 Arraypop JIT type confusion exploit with sandbox escape ...

Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.

Full chain exploit for CVE-2019-11708 & CVE-2019-9810 This is a full browser compromise exploit chain (CVE-2019-11708 & CVE-2019-9810) targeting Firefox on Windows 64-bit It uses CVE-2019-9810 for getting code execution in both the content process as well as the parent process and CVE-2019-11708 to trick the parent process into browsing to an arbitrary URL

This is a list of offensive security tools that I have curated and actaully saved..

List-O-Tools This is a list of offensive security tools that I have curated and actaully saved githubcom/751643992/whale githubcom/751643992/LittleCCompiler githubcom/751643992/shellcode githubcom/odzhan/acorn githubcom/odzhan/injection githubcom/odzhan/dewifi githubcom/odzhan/polymutex githubcom/TonyChen

Exploit chain for CVE-2019-9791 & CVE-2019-11708 against firefox 65.0 on windows 64bit

Exploit chain for CVE-2019-9791 & CVE-2019-11708 against Firefox 650 Works against Firefox 650 on windows 64bit CVE-2019-11708 part is taken from exploit by 0vercl0k: githubcom/0vercl0k/CVE-2019-11708 The exploit uses CVE-2019-9791 to obtain read/write primitive in content process then CVE-2019-11708 to make the main process load arbitrary url In parent pr

Edwin's stars.

Awesome Stars A curated list of my GitHub stars! Generated by starred Contents ANTLR ASL Ada Assembly AutoHotkey Awk Ballerina Batchfile Bicep Blade Brainfuck C C# C++ CMake CSS CUE Clojure CodeQL CoffeeScript Common Lisp Coq Crystal Cuda Cython D Dart Dhall Dockerfile Elixir Emacs Lisp Erlang F# F* Fennel Forth Fortran Frege GDScript Gherkin Go Groovy HCL HTML Haml Handle

Submitting a text entry box or a website url

COINBASE HOW COINBASE BECAME THE LEADING CRYPTOCURRENCY APP IN THE USA Coinbase Global, Inc, branded Coinbase is an American publicly traded company that operates a cryptocurrency exchange platform The company was founded in 2012 and it's headquarters were based in San Francisco, California until May 2020 when the company decided to move to a remote-first working enviro

IT threat evolution Q2 2019. Statistics

Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Boris Larin Oleg Kupreev Evgeny Lopatin • 19 Aug 2019

These statistics are based on detection verdicts of Kaspersky products received from users who consented to provide statistical data. According to Kaspersky Security Network, Q2 2019 will be remembered for several events. First, we uncovered a large-scale financial threat by the name of Riltok, which targeted clients of not only major Russian banks, but some foreign ones too. Second, we detected the new Trojan.AndroidOS.MobOk malware, tasked with stealing money from mobile accounts through explo...

CVE-2019-11708

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect