CVE-2019-11708

Mozilla Firefox and Thunderbird Sandbox Escape

10.0 CRITICALActively exploited (CISA KEV)EPSS 55.9%

Published23 Jul 2019
Added to CISA KEV23 May 2022
Remediation due13 Jun 2022

Description

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Mozilla Firefox< 67.0.4 · < 60.7.2

Mozilla Thunderbird< 60.7.2

Remediation

Fixed in

Mozilla Firefox≥ 67.0.4

Mozilla Thunderbird≥ 60.7.2

Patch & vendor advisories

References

http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.htmlThird Party AdvisoryVDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1559858Issue TrackingVendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11708US Government Resource
https://www.mozilla.org/security/advisories/mfsa2019-19/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-20/Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-11708 being actively exploited?

Yes. CVE-2019-11708 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 23 May 2022.

How severe is CVE-2019-11708?

CVE-2019-11708 has a CVSS 3.1 base score of 10.0, rated critical. EPSS estimates a 55.9% probability of exploitation.

Which products are affected by CVE-2019-11708?

Affected products include Mozilla Firefox, Mozilla Thunderbird.

How do I fix CVE-2019-11708?

Upgrade affected software to a fixed version, for example Mozilla Firefox 67.0.4, Mozilla Thunderbird 60.7.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-11708 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.