CVE-2019-9811: High severity Mozilla Thunderbird vulnerability
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Other sources
As part of his winning Pwn2Own entry, Niklas Baumstark demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 68 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.8 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 60.8.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 68.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-9811?
CVE-2019-9811 is a vulnerability that allows a sandbox escape in Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
How can this vulnerability be exploited?
This vulnerability can be exploited by installing a malicious language pack and then opening a browser feature that uses the compromised translation.
Which software versions are affected by CVE-2019-9811?
Firefox ESR versions prior to 60.8, Firefox versions prior to 68, and Thunderbird versions prior to 60.8 are affected.
What is the severity of CVE-2019-9811?
CVE-2019-9811 has a severity rating of 8.3 (high).
Is there a fix available for CVE-2019-9811?
Yes, updating to Firefox ESR 60.8 or later, Firefox 68 or later, or Thunderbird 60.8 or later will fix the vulnerability.