CVE-2019-9793

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Apr 26, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-97949.8A vulnerability was discovered where specific command line arguments are not properly discarded during Firefox invocation as a shell handlerCVE-2019-97959.8A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to triggCVE-2019-97969.8A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a CVE-2019-97975.3Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the imageCVE-2019-97987.4On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow maliciouCVE-2019-97997.5Insufficient bounds checking of data during inter-process communication might allow a compromised content process to be able to read memory CVE-2019-98009.8Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of CVE-2019-98015.3Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matchiCVE-2019-98027.5If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded daCVE-2019-98037.4The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-CVE-2019-98049.8In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause theCVE-2019-98059.8A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential