CVE-2019-9800

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 60.7
Mozilla	Firefox	>= unspecified, < 67
Mozilla	Firefox ESR	>= unspecified, < 60.7

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540166%2C1534593%2C1546327%2C1540136%2C1538736%2C1538042%2C1535612%2C1499719%2C1499108%2C1538619%2C1535194%2C1516325%2C1542324%2C1542097%2C1532465%2C1533554%2C1541580Permissions Required
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-14/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-15/Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540166%2C1534593%2C1546327%2C1540136%2C1538736%2C1538042%2C1535612%2C1499719%2C1499108%2C1538619%2C1535194%2C1516325%2C1542324%2C1542097%2C1532465%2C1533554%2C1541580Permissions Required
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-14/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-15/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98015.3Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matchi CVE-2019-98027.5If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded da CVE-2019-98037.4The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP), navigation to a same-CVE-2019-98049.8In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the CVE-2019-98059.8A latent vulnerability exists in the Prio library where data may be read from uninitialized memory for some functions, leading to potential CVE-2019-98067.5A vulnerability exists during authorization prompting for FTP transaction where successive modal prompts are displayed and cannot be immedia CVE-2019-98074.3When arbitrary text is sent over an FTP connection and a page reload is initiated, it is possible to create a modal alert message with this CVE-2019-98085.3If WebRTC permission is requested from documents with data: or blob: URLs, the permission notifications do not properly display the originat CVE-2019-98097.5If the source for resources on a page is through an FTP connection, it is possible to trigger a series of modal alert messages for these res CVE-2019-98108.8Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflo CVE-2019-98118.3As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a br CVE-2019-98129.3Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.fir