4.3
CVSSv2

CVE-2019-9793

Published: 26/04/2019 Updated: 13/05/2019
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Summary

A mechanism exists that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an malicious user to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

mozilla firefox esr

mozilla thunderbird

mozilla firefox

Vendor Advisories

Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Critical: firefox security update Type/Severity Security Advisory: Critical Topic An update for firefox is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Critical A Common Vulnerability Scoring System (CVSS) base score, wh ...
Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Topic An update for thunderbird is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) bas ...
Multiple security issues have been found in the Thunderbird mail client, which could lead to the execution of arbitrary code or denial of service For the stable distribution (stretch), these problems have been fixed in version 1:6061-1~deb9u1 We recommend that you upgrade your thunderbird packages For the detailed security status of thunderbir ...
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code For the stable distribution (stretch), these problems have been fixed in version 6060esr-1~deb9u1 We recommend that you upgrade your firefox-esr packages For the detailed security status of firefox-esr ...
Several security issues were fixed in Firefox ...
USN-3918-1 caused a regression in Firefox ...
Several security issues were fixed in Firefox ...
USN-3918-1 caused a regression in Firefox ...
Several security issues were fixed in Thunderbird ...
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the proxy to another server This behavior is disallowed by default when a proxy is manually configured, but when enabled could allow f ...
A mechanism was discovered in Firefox before 660 that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circu ...
Mozilla Foundation Security Advisory 2019-11 Security vulnerabilities fixed in Thunderbird 606 Announced March 19, 2019 Impact critical Products Thunderbird Fixed in Thunderbird 606 ...
Mozilla Foundation Security Advisory 2019-07 Security vulnerabilities fixed in Firefox 66 Announced March 19, 2019 Impact critical Products Firefox Fixed in Firefox 66 ...
Mozilla Foundation Security Advisory 2019-08 Security vulnerabilities fixed in Firefox ESR 606 Announced March 19, 2019 Impact critical Products Firefox ESR Fixed in Firefox ESR 606 ...