Published: 02/03/2020 Updated: 16/11/2022

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 607

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

A type confusion vulnerability has been found in Firefox prior to 72.0.1. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement. Mozilla is aware of targeted attacks in the wild abusing this flaw.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla thunderbird
mozilla firefox esr
canonical ubuntu linux 16.04

Debian Bug report logs - #948452 firefox: Please update to 7201 (and firefox-esr to 6841) because of CVE-2019-17026 Package: firefox; Maintainer for firefox is Maintainers of Mozilla-related packages <team+pkg-mozilla@trackerdebianorg>; Source for firefox is src:firefox (PTS, buildd, popcon) Reported by: jim_p <pits ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability ...

Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 80 Update Services for SAP SolutionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vul ...

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...

Several security issues were fixed in Thunderbird ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, data exfiltration or cross-site scripting For the oldstable distribution (stretch), this problem has been fixed in version 6841esr-1~deb9u1 For the stable distribution (buster), this problem has been fi ...

Multiple security issues have been found in Thunderbird which could potentially result in the execution of arbitrary code or information disclosure For the oldstable distribution (stretch), these problems have been fixed in version 1:6841-1~deb9u1 For the stable distribution (buster), these problems have been fixed in version 1:6841-1~deb10u1 ...

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule This could allow for injection into certain types of websites resulting in data exfiltration This vulnerability affects Firefox ESR < 684 and Firefox < 72 (CVE-2019-17016) Mozilla developers reported memor ...

Mozilla Foundation Security Advisory 2020-03 Security Vulnerabilities fixed in Firefox 7201 and Firefox ESR 6841 Announced January 8, 2020 Impact critical Products Firefox, Firefox ESR Fixed in Fire ...

Mozilla Foundation Security Advisory 2020-04 Security Vulnerabilities fixed in Thunderbird 6841 Announced January 10, 2020 Impact critical Products Thunderbird Fixed in Thunderbird 6841 ...

A type confusion vulnerability has been found in Firefox before 7201 Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement Mozilla is aware of targeted attacks in the wild abusing this flaw ...

Mozilla Firefox version 67 Arraypop JIT type confusion exploit with sandbox escape ...

Firefox 72 IonMonkey JIT type confusion exploit ...

Lansweeper SQL reports.

Lansweeper reports Lansweeper SQL reports You can use them to filter your assets Vulnerability reports firefox-cve-2019-17026sql - list all assets with installed Firefox Asset is marked if Firefox version is lower than 7201 or Firefox ESR lower than 6841

The Unofficial Incomplete Spidermonkey Bibliography

A collection of links to published articles, blog posts, talks, and other important pieces of history of the SpiderMonkey JavaScript engine The goal is try to collect together much of what has been written about SpiderMonkey across the internet This includes research done atop SpiderMonkey, as well as techniques and advances within the engine Annotations 🏚 Obsolete: Code

A personalized/enhanced re-creation of the Darkhotel "Double Star" APT exploit chain with a focus on Windows 8.1 and mixed with some of my own techniques

________ ___ __ _________ __ \______ \ ____ __ __\_ |__ | | ____ / _____/_/ |_ _____ _______ | | \ / _ \ | | \| __ \ | | _/ __ \ \_____ \ \ __\\__ \ \_ __ \ | ` \( <_> )| | /| \_\ \| |__\ ___/ / \ | | / __ \_| | \/ /_______ / \____/ |____/ |___ /|____/ \___

An exploit for CVE-2019-17026. It pops xcalc and was tested on Ubuntu (x64).

CVE-2019-17026 - A Firefox JIT bug Original bug caught in the wild by Qihoo 360 Exploit written by maxpl0it Works on Firefox < 7201 This is an exploit for CVE-2190-17026: IonMonkey type confusion with StoreElementHole and FallibleStoreElement This exploit does not use a sandbox escape, so for testing the securitysandboxcontentlevel attribute in about:config need

Script in PowerShell to detect vulnerable versions of Mozilla Firefox in a Windows domain.

Mozilla Firefox Vulnerability Scanner for Domain Description: Script in PowerShell to detect vulnerable versions of Mozilla Firefox in a Windows domain CVEs: CVE-2019-17026 and previous Considerations: Well configured WinRM on remote machines Well configured firewall rules Allow ping to remote machines from the Domain Controller Run the script with the Unrestricted or Byp

IT threat evolution Q1 2020. Statistics

Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Oleg Kupreev Evgeny Lopatin Alexey Kulaev • 20 May 2020

These statistics are based on detection verdicts for Kaspersky products received from users who consented to providing statistical data. According to Kaspersky Security Network, Q1 2020 will be remembered primarily for the coronavirus pandemic and cybercriminals’ exploitation of the topic. In particular, the creators of a new modification of the Ginp banking trojan renamed their malware Coronavirus Finder and then began offering it for €0.75 disguised as an app supposedly capable of detectin...

CVE-2019-17026

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect