CVE-2019-11752

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 69
MozillaThunderbird>= unspecified, < 68.1; >= unspecified, < 60.9
MozillaFirefox ESR>= unspecified, < 60.9; >= unspecified, < 68.1

References

Timeline

Published
Sep 27, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-117537.8The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unpriviCVE-2019-117544.3When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious websiCVE-2019-117557.5A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signatureCVE-2019-117568.8Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vulnCVE-2019-117578.8When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. ThiCVE-2019-117588.8Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed eCVE-2019-117598.8An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an atCVE-2019-11767.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thiCVE-2019-117608.8A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some iCVE-2019-117615.4By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact fCVE-2019-117626.1If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/CVE-2019-117636.1Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have
CVE-2019-11752: High severity, CVSS 8.8 | Vulnix