CVE-2019-11709

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MozillaFirefox ESR>= unspecified, < 60.8
MozillaFirefox>= unspecified, < 68
MozillaThunderbird>= unspecified, < 60.8

References

Timeline

Published
Jul 23, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-11715.6An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vulCVE-2019-117109.8Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corCVE-2019-117118.8When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomaiCVE-2019-117128.8POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allowCVE-2019-117139.8A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially explCVE-2019-117149.8Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vuCVE-2019-117156.1Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards onCVE-2019-117168.3Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPropeCVE-2019-117175.3A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allCVE-2019-117185.3Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream CVE-2019-117197.5When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the NetwCVE-2019-11724.3An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An
CVE-2019-11709: Critical severity, CVSS 9.8 | Vulnix