CVE-2019-11692

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 60.7
Mozilla	Firefox	>= unspecified, < 67
Mozilla	Firefox ESR	>= unspecified, < 60.7

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1544670Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-14/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-15/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1544670Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-14/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-15/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-116939.8The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious CVE-2019-116947.5A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a CVE-2019-116954.3A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allo CVE-2019-116967.8Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though CVE-2019-116976.5If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install CVE-2019-116985.3If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped CVE-2019-116996.5A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could CVE-2019-11707.9An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker w CVE-2019-117006.5A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution wh CVE-2019-117016.1The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place a CVE-2019-117026.5A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with In CVE-2019-117039.8A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages,