CVE-2019-11694

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-755 CWE-908

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-116954.3A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allo CVE-2019-116967.8Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though CVE-2019-116976.5If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install CVE-2019-116985.3If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped CVE-2019-116996.5A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could CVE-2019-11707.9An elevation of privilege vulnerability exists when reparse points are created by sandboxed processes allowing sandbox escape. An attacker w CVE-2019-117006.5A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution wh CVE-2019-117016.1The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place a CVE-2019-117026.5A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with In CVE-2019-117039.8A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages,CVE-2019-117049.8A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email CVE-2019-117059.8A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email mess