CVE-2019-11759

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published
Jan 8, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-11767.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thiCVE-2019-117608.8A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploitable crash in some iCVE-2019-117615.4By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact fCVE-2019-117626.1If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call arbitrary DOM methods/CVE-2019-117636.1Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could haveCVE-2019-117648.8Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some of these bugs showed eCVE-2019-117656.5A compromised content process could send a message to the parent process that would cause the 'Click to Play' permission prompt to be shown.CVE-2019-117669.8dhcp6.c in dhcpcd before 6.11.7 and 7.x before 7.2.2 has a buffer over-read in the D6_OPTION_PD_EXCLUDE feature.CVE-2019-117675.8Server side request forgery (SSRF) in phpBB before 3.2.6 allows checking for the existence of files and services on the local network of theCVE-2019-117689.8An issue was discovered in phpMyAdmin before 4.9.0.1. A vulnerability was reported where a specially crafted database name can be used to trCVE-2019-117697.8An issue was discovered in TeamViewer 14.2.2558. Updating the product as a non-administrative user requires entering administrative credentiCVE-2019-11777.0An elevation of privilege vulnerability exists in the way that the rpcss.dll handles objects in memory. An attacker who successfully exploit
CVE-2019-11759: High severity, CVSS 8.8 | Vulnix