CVE-2019-11758

moderate-risk
Published 2020-01-08

Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed evidence of memory corruption in the accessibility engine and we presume that with enough effort that it could be exploited to run arbitrary code. This vulnerability affects Firefox < 69, Thunderbird < 68.2, and Firefox ESR < 68.2.

Do I need to act?

-
0.85% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (4)

Affected Vendors

Mozilla Canonical

References (10)

Exploit https://bugzilla.mozilla.org/show_bug.cgi?id=1536227
Third Party Advisory https://usn.ubuntu.com/4335-1/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-25/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-33/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-35/
Exploit https://bugzilla.mozilla.org/show_bug.cgi?id=1536227
Third Party Advisory https://usn.ubuntu.com/4335-1/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-25/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-33/
Vendor Advisory https://www.mozilla.org/security/advisories/mfsa2019-35/
43
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 3/34 · Minimal
Exposure 10/34 · Low