CVE-2019-11707

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: May 23, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-1170810.0Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxe CVE-2019-117099.8Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed e CVE-2019-11715.6An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vul CVE-2019-117109.8Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory cor CVE-2019-117118.8When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomai CVE-2019-117128.8POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow CVE-2019-117139.8A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially expl CVE-2019-117149.8Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vu CVE-2019-117156.1Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on CVE-2019-117168.3Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPrope CVE-2019-117175.3A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, all CVE-2019-117185.3Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream