9.8
CVSSv3

CVE-2019-9791

Published: 26/04/2019 Updated: 30/03/2022
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 755
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

It exists that Thunderbird allowed PAC files to specify that requests to localhost are sent through the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit this to conduct attacks on local services and tools. (CVE-2018-18506)

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla thunderbird

mozilla firefox

mozilla firefox esr

redhat enterprise linux 8.0

redhat enterprise linux eus 8.1

redhat enterprise linux eus 8.2

redhat enterprise linux eus 8.4

redhat enterprise linux server aus 8.2

redhat enterprise linux server aus 8.4

redhat enterprise linux server tus 8.2

redhat enterprise linux server tus 8.4

Vendor Advisories

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Multiple security issues have been found in the Thunderbird mail client, which could lead to the execution of arbitrary code or denial of service For the stable distribution (stretch), these problems have been fixed in version 1:6061-1~deb9u1 We recommend that you upgrade your thunderbird packages For the detailed security status of thunderbir ...
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code For the stable distribution (stretch), these problems have been fixed in version 6060esr-1~deb9u1 We recommend that you upgrade your firefox-esr packages For the detailed security status of firefox-esr ...
Several security issues were fixed in Firefox ...
USN-3918-1 caused a regression in Firefox ...
Several security issues were fixed in Firefox ...
USN-3918-1 caused a regression in Firefox ...
Several security issues were fixed in Thunderbird ...
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow f ...
The type inference system in Firefox before 660 allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR) This allows for possible arbitrary reading and writing of objec ...
Mozilla Foundation Security Advisory 2019-11 Security vulnerabilities fixed in Thunderbird 606 Announced March 19, 2019 Impact critical Products Thunderbird Fixed in Thunderbird 606 ...
Mozilla Foundation Security Advisory 2019-07 Security vulnerabilities fixed in Firefox 66 Announced March 19, 2019 Impact critical Products Firefox Fixed in Firefox 66 ...
Mozilla Foundation Security Advisory 2019-08 Security vulnerabilities fixed in Firefox ESR 606 Announced March 19, 2019 Impact critical Products Firefox ESR Fixed in Firefox ESR 606 ...

Exploits

/* A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement (OSR) allows the compilation of JITed functions that cause type confusions between arbitrary objects # Prerequisites: 1 Spidermonkey can represent "plain" objects either as NativeObject (githubcom/mozilla/gecko-d ...
A bug in IonMonkeys type inference system when JIT compiling and entering a constructor function via on-stack replacement (OSR) allows the compilation of JITed functions that cause type confusions between arbitrary objects ...

Github Repositories

Exploit chain for CVE-2019-9791 & CVE-2019-11708 against firefox 65.0 on windows 64bit

Exploit chain for CVE-2019-9791 & CVE-2019-11708 against Firefox 650 Works against Firefox 650 on windows 64bit CVE-2019-11708 part is taken from exploit by 0vercl0k: githubcom/0vercl0k/CVE-2019-11708 The exploit uses CVE-2019-9791 to obtain read/write primitive in content process then CVE-2019-11708 to make the main process load arbitrary url In parent pr