Vulnerability Details : CVE-2019-11758
Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.
Vulnerability category: Memory Corruption
Exploit prediction scoring system (EPSS) score for CVE-2019-11758
Probability of exploitation activity in the next 30 days: 0.59%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 75 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2019-11758
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
[email protected] |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
[email protected] |
CWE ids for CVE-2019-11758
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by: [email protected] (Primary)
References for CVE-2019-11758
-
https://www.mozilla.org/security/advisories/mfsa2019-25/
Vendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2019-35/
Vendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1536227
Exploit;Issue Tracking;Vendor Advisory
-
https://usn.ubuntu.com/4335-1/
Third Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2019-33/
Vendor Advisory
Products affected by CVE-2019-11758
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*