First published: Tue May 21 2019(Updated: )
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Credit: security@mozilla.org security@mozilla.org
Affected Software | Affected Version | How to fix |
---|---|---|
Mozilla Thunderbird | <60.7 | 60.7 |
Mozilla Firefox ESR | <60.7 | 60.7 |
Mozilla Firefox | <67 | 67 |
Mozilla Firefox | <67.0 | |
Mozilla Firefox ESR | <60.7 | |
Mozilla Thunderbird | <60.7 | |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/firefox | <67.0 | 67.0 |
ubuntu/firefox | <67.0+ | 67.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
ubuntu/thunderbird | <60.7 | 60.7 |
ubuntu/thunderbird | <1:60.7.0+ | 1:60.7.0+ |
debian/firefox | 125.0.3-1 | |
debian/firefox-esr | 91.12.0esr-1~deb10u1 115.10.0esr-1~deb10u1 115.7.0esr-1~deb11u1 115.10.0esr-1~deb11u1 115.7.0esr-1~deb12u1 115.10.0esr-1~deb12u1 115.10.0esr-1 | |
debian/thunderbird | 1:91.12.0-1~deb10u1 1:115.10.1-1~deb10u1 1:115.7.0-1~deb11u1 1:115.10.1-1~deb11u1 1:115.7.0-1~deb12u1 1:115.10.1-1~deb12u1 1:115.10.1-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
The vulnerability ID for this issue is CVE-2019-9816.
The severity of CVE-2019-9816 is high.
The affected software is Mozilla Firefox and Mozilla Thunderbird.
To fix CVE-2019-9816, update Mozilla Firefox and Mozilla Thunderbird to version 67.0+ or higher.
You can find more information about CVE-2019-9816 at the following references: [Reference 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1536768), [Reference 2](https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/), [Reference 3](https://www.mozilla.org/security/advisories/mfsa2019-13/).