CVE-2019-9811

HIGH

Firefox ESR < 60.8, Firefox < 68, Thunderbird < 60.8 - Privilege Es...

Title source: llm
STIX 2.1

Description

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

References (15)

Core 15
Core References
Issue Tracking, Permissions Required x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1538007
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1539598
Exploit, Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1563327
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201908-12
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201908-20
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html

Scores

CVSS v3 8.3
EPSS 0.0067
EPSS Percentile 71.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-74
Status published
Products (7)
debian/debian_linux 8.0
mozilla/firefox < 68.0
mozilla/firefox_esr < 60.8
mozilla/thunderbird < 60.8
novell/suse_package_hub_for_suse_linux_enterprise 12
opensuse/leap 15.0
opensuse/leap 15.1
Published Jul 23, 2019
Tracked Since Feb 18, 2026