All vulnerabilities
CVE-2019-17026

Mozilla Firefox And Thunderbird Type Confusion Vulnerability

Mozilla Firefox and ThunderbirdApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationExploited in the wildAdded to KEV 3 Nov 2021CISA KEV
Exploit odds (EPSS)46.3%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in68.4.1Also 72.0.1CVE List
Federal deadline3 May 2022Remediation due date for US federal agenciesCISA KEV
CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 2 Mar 2020, 04:05 UTCPublishedCVE List
  2. 13 May 2021Exploit code publicExploit-DB
  3. 3 Nov 2021Added to CISA KEVCISA KEV

Public exploit code and templates 1

  • Local exploitFirefox 72 IonMonkey - JIT Type Confusion 13 May 2021Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Mozilla Firefox and Thunderbird contain a type confusion vulnerability due to incorrect alias information in the IonMonkey JIT compiler when setting array elements.

Text from CVE List

Affected versions 3

  • Firefox ESRaffected: unspecified before 68.4.1CVE List
  • Thunderbirdaffected: unspecified before 68.4.1CVE List
  • Firefoxaffected: unspecified before 72.0.1CVE List

References 7