Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2019-9800: Firefox ESR and Thunderbird could let attackers run code
CVE-2019-9800 · published 7 years ago
Summary
Memory handling bugs have been found in Firefox ESR (versions before 67) and Thunderbird (versions before 60.7). If exploited, these bugs could let a malicious site or email cause the program to execute unwanted code on a user's computer. Updating to the latest versions of Firefox ESR and Thunderbird fixes the problem.
What to do
- Update debian firefox-esr to version 60.7.0esr-1.
- Update debian thunderbird to version 1:60.7.0-1.
- Update mozilla firefox to version 67.0 or later.
- Update mozilla firefox_esr to version 60.7 or later.
- Update mozilla thunderbird to version 60.7 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 60.7.0esr-1 Fix: upgrade to 60.7.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 60.7.0esr-1 Fix: upgrade to 60.7.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 60.7.0esr-1 Fix: upgrade to 60.7.0esr-1
|
| Debian:12 | debian | thunderbird |
< 1:60.7.0-1 Fix: upgrade to 1:60.7.0-1
|
| Debian:13 | debian | thunderbird |
< 1:60.7.0-1 Fix: upgrade to 1:60.7.0-1
|
| Debian:14 | debian | thunderbird |
< 1:60.7.0-1 Fix: upgrade to 1:60.7.0-1
|
| – | mozilla | firefox |
< 67.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 60.7 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 60.7 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we pr...
Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
References
- https://security-tracker.debian.org/tracker/CVE-2019-9800 Vendor Advisory
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540166%2C1534593%2C1546327%2C15... Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2019-13/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-14/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-15/ Vendor Advisory
Severity
9.8
Critical
Type
CWE-787Out-of-bounds Write
Timeline
Published23 Jul 2019
Updated3 Nov 2026
First seen21 Sep 2026
Track software like this
Free during beta