CVE-2019-9791: vulnerability in Mozilla Thunderbird
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 20%
from disclosure to weaponsame day
Published on NVDApr 26
1st PoCMar 26
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
public PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/46613githubgithub.com/Sp0pielar/CVE-2019-9791★ 2⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Mozilla Thunderbird
In the same product, most dangerous first.
References
https://access.redhat.com/errata/RHSA-2019:0966https://access.redhat.com/errata/RHSA-2019:1144https://bugzilla.mozilla.org/show_bug.cgi?id=1530958https://www.mozilla.org/security/advisories/mfsa2019-07/https://www.mozilla.org/security/advisories/mfsa2019-08/https://www.mozilla.org/security/advisories/mfsa2019-11/