CVE-2019-9814

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mozilla developers and community members reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 67.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 67

References

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425Permissions Required
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425Permissions Required
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-98158.1If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.CVE-2019-98165.9A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypas CVE-2019-98175.3Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a differ CVE-2019-98188.3A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-CVE-2019-98199.8A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable c CVE-2019-98209.8A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially expl CVE-2019-98218.1A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially ex CVE-2019-98239.8In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to saving a cleartext re CVE-2019-98245.5tcp_emu in slirp/tcp_subr.c (aka slirp/src/tcp_subr.c) in QEMU 3.0.0 uses uninitialized data in an snprintf call, leading to Information dis CVE-2019-98259.8FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set CVE-2019-98267.5The fulltext search component in phpBB before 3.2.6 allows Denial of Service.CVE-2019-98279.8Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitra