How severe is CVE-2019-11707?

CVE-2019-11707 has a CVSS 3.1 base score of 8.8 (HIGH). EPSS estimates a 37.7% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion

CISA Known Exploited Vulnerabilities

Mozilla Firefox and Thunderbird Type Confusion Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-05-23

Remediation due

2022-06-13

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2019-11707

Description

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

Severity

CVSS 3.1 · CISA8.8 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableno

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Mozilla	Firefox ESR	unspecified to <60.7.1
Mozilla	Firefox	unspecified to <67.0.3
Mozilla	Thunderbird	unspecified to <60.7.2

References

4 Links

Vendor advisories

GLSA-201908-12

Other references

Record Details

Published

2019-07-23

Last updated

2025-10-21

Assigner (CNA)

mozilla

Credited to

More from Mozilla

CVE-2016-90797.5

Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability

CVE-2019-1170810

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

CVE-2019-170268.8

Mozilla Firefox And Thunderbird Type Confusion Vulnerability

CVE-2024-96809.8

Mozilla Firefox Use-After-Free Vulnerability

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.