Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2019-9810: Firefox ESR may allow buffer overflow via array slice
CVE-2019-9810 · published 7 years ago
Summary
The Firefox web browser and Thunderbird email client versions before the indicated updates can mishandle a common JavaScript operation, potentially skipping a safety check. This mistake could let a specially crafted webpage cause a buffer overflow, which might let an attacker run code on a user's computer. Updating Firefox and Thunderbird to the latest available versions resolves the issue.
What to do
- Update debian firefox-esr to version 60.6.1esr-1.
- Update mozilla thunderbird to version 60.6.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 60.6.1esr-1 Fix: upgrade to 60.6.1esr-1
|
| Debian:13 | debian | firefox-esr |
< 60.6.1esr-1 Fix: upgrade to 60.6.1esr-1
|
| Debian:14 | debian | firefox-esr |
< 60.6.1esr-1 Fix: upgrade to 60.6.1esr-1
|
| – | mozilla | firefox |
< 60.6.1 < 66.0.1 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | thunderbird |
< 60.6.1 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
8.0 cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_eus |
8.1 8.2 8.4 cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_aus |
8.2 8.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux_server_tus |
8.2 8.4 cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
Original advisory text
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox E...
Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.
References
- http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain... Exploit Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2019:0966 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1144 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 Exploit Issue Tracking Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-09/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-10/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-12/ Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2019-9810 Vendor Advisory
Severity
8.8
High
Type
CWE-119Buffer Overflow
Timeline
Published26 Apr 2019
Updated23 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta