CVE-2019-11710

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 68.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 68

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1549768%2C1548611%2C1533842%2C1537692%2C1540590%2C1551907%2C1510345%2C1535482%2C1535848%2C1547472%2C1547760%2C1507696%2C1544180Issue Tracking, Vendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1549768%2C1548611%2C1533842%2C1537692%2C1540590%2C1551907%2C1510345%2C1535482%2C1535848%2C1547472%2C1547760%2C1507696%2C1544180Issue Tracking, Vendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117118.8When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomai CVE-2019-117128.8POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow CVE-2019-117139.8A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting in a potentially expl CVE-2019-117149.8Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in some instances. This vu CVE-2019-117156.1Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on CVE-2019-117168.3Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such as Object.getOwnPrope CVE-2019-117175.3A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, all CVE-2019-117185.3Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream CVE-2019-117197.5When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Netw CVE-2019-11724.3An information disclosure vulnerability exists in Azure Active Directory (AAD) Microsoft Account (MSA) during the login request session. An CVE-2019-117206.1Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This a CVE-2019-117216.5The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for domain spoofing attacks a