CVE-2019-9816: Medium severity Mozilla Thunderbird vulnerability
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
Other sources
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups.
Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816
— Red Hat
A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.
— Mozilla
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 67 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.7 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2019-9815
- CVE-2019-9816
- CVE-2019-9817
- CVE-2019-9818
- CVE-2019-9819
- CVE-2019-9820
- CVE-2019-11691
- CVE-2019-11692
- CVE-2019-11693
- CVE-2019-7317
- CVE-2019-9797
- CVE-2018-18511
- CVE-2019-11694
- CVE-2019-11698
- CVE-2019-5798
- CVE-2019-9800
- CVE-2019-9821
- CVE-2019-11695
- CVE-2019-11696
- CVE-2019-11697
- CVE-2019-11700
- CVE-2019-11699
- CVE-2019-11701
- CVE-2019-9814
- DLA-1800-1
- DLA-1806-1
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-9816.
What is the severity of CVE-2019-9816?
The severity of CVE-2019-9816 is high.
What is the affected software?
The affected software is Mozilla Firefox and Mozilla Thunderbird.
How can I fix CVE-2019-9816?
To fix CVE-2019-9816, update Mozilla Firefox and Mozilla Thunderbird to version 67.0+ or higher.
Where can I find more information about CVE-2019-9816?
You can find more information about CVE-2019-9816 at the following references: [Reference 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1536768), [Reference 2](https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/), [Reference 3](https://www.mozilla.org/security/advisories/mfsa2019-13/).