CVE-2019-11758 - Mozilla: Potentially exploitable crash due to 360 Total Security

Back Back to CVE browser

HIGH

Mozilla: Potentially exploitable crash due to 360 Total Security

Published Jan 8, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.33%

Description

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  before 69
  Status
  affected
  Constraints
  -
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  before 68.2
  Status
  affected
  Constraints
  -
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  before 68.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
before 69	affected	-

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
before 68.2	affected	-

Mozilla

Thunderbird

n/a

Version	Status	Constraints
before 68.2	affected	-

Red Hat Enterprise Linux 6

firefox-0:68.2.0-4.el6_10

Fixed · RHSA-2019:3281
Red Hat Enterprise Linux 6

thunderbird-0:68.2.0-2.el6_10

Fixed · RHSA-2019:3756
Red Hat Enterprise Linux 7

firefox-0:68.2.0-1.el7_7

Fixed · RHSA-2019:3193
Red Hat Enterprise Linux 7

thunderbird-0:68.2.0-1.el7_7

Fixed · RHSA-2019:3210
Red Hat Enterprise Linux 8

firefox-0:68.2.0-2.el8_0

Fixed · RHSA-2019:3196
Red Hat Enterprise Linux 8

thunderbird-0:68.2.0-1.el8_0

Fixed · RHSA-2019:3237
Red Hat Enterprise Linux 5

firefox

Out of support scope
Red Hat Enterprise Linux 5

thunderbird

Out of support scope

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	firefox-0:68.2.0-4.el6_10	Fixed	RHSA-2019:3281
Red Hat Enterprise Linux 6	thunderbird-0:68.2.0-2.el6_10	Fixed	RHSA-2019:3756
Red Hat Enterprise Linux 7	firefox-0:68.2.0-1.el7_7	Fixed	RHSA-2019:3193
Red Hat Enterprise Linux 7	thunderbird-0:68.2.0-1.el7_7	Fixed	RHSA-2019:3210
Red Hat Enterprise Linux 8	firefox-0:68.2.0-2.el8_0	Fixed	RHSA-2019:3196
Red Hat Enterprise Linux 8	thunderbird-0:68.2.0-1.el8_0	Fixed	RHSA-2019:3237
Red Hat Enterprise Linux 5	firefox	Out of support scope	n/a
Red Hat Enterprise Linux 5	thunderbird	Out of support scope	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-122

CWE-787

Out-of-bounds Write

References (11)

https://access.redhat.com/security/cve/CVE-2019-11758
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1536227
x_refsource_CONFIRMExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1764439
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3428
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11758
https://usn.ubuntu.com/4335-1/
vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11758
https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11758
https://www.mozilla.org/security/advisories/mfsa2019-25/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-33/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-35/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-11758		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1536227		x_refsource_CONFIRMExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1764439		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3428		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11758
https://usn.ubuntu.com/4335-1/		vendor-advisoryx_refsource_UBUNTUThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11758
https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11758
https://www.mozilla.org/security/advisories/mfsa2019-25/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-33/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-35/		x_refsource_CONFIRMVendor Advisory