CVE-2019-9816

MEDIUM

Thunderbird <60.7-Firefox <67-Firefox ESR <60.7 - Code Injection

Title source: llm
STIX 2.1

Description

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · textdosmultiple
https://www.exploit-db.com/exploits/46940

References (4)

Core 4
Core References
Permissions Required x_refsource_misc
https://bugzilla.mozilla.org/show_bug.cgi?id=1536768

Scores

CVSS v3 5.9
EPSS 0.3825
EPSS Percentile 97.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-843
Status published
Products (3)
mozilla/firefox < 67.0
mozilla/firefox_esr < 60.7
mozilla/thunderbird < 60.7
Published Jul 23, 2019
Tracked Since Feb 18, 2026