{"id":"CVE-2019-11707","state":"PUBLISHED","title":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks ","description":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.","publishedAt":"2019-07-23T13:20:17.000Z","updatedAt":"2025-10-21T23:45:33.091Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"mozilla","products":["Mozilla Firefox ESR","Mozilla Firefox","Mozilla Thunderbird"],"affected":[{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","status":"affected","lessThan":"60.7.1","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"67.0.3","versionType":"custom"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","status":"affected","lessThan":"60.7.2","versionType":"custom"}]}],"references":["https://www.mozilla.org/security/advisories/mfsa2019-20/","https://www.mozilla.org/security/advisories/mfsa2019-18/","https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","https://security.gentoo.org/glsa/201908-12","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707"],"weaknesses":["CWE-843"],"ingestedAt":"2026-10-29T19:45:22.458Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/11xxx/CVE-2019-11707.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-11707","state":"PUBLISHED","datePublished":"2019-07-23T13:20:17.000Z","dateUpdated":"2025-10-21T23:45:33.091Z","assignerShortName":"mozilla","assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","dateReserved":"2019-05-03T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2."}],"affected":[{"vendor":"Mozilla","product":"Firefox ESR","versions":[{"version":"unspecified","status":"affected","lessThan":"60.7.1","versionType":"custom"}]},{"vendor":"Mozilla","product":"Firefox","versions":[{"version":"unspecified","status":"affected","lessThan":"67.0.3","versionType":"custom"}]},{"vendor":"Mozilla","product":"Thunderbird","versions":[{"version":"unspecified","status":"affected","lessThan":"60.7.2","versionType":"custom"}]}],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/","tags":["x_refsource_MISC"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","tags":["x_refsource_MISC"]},{"url":"https://security.gentoo.org/glsa/201908-12","name":"GLSA-201908-12","tags":["vendor-advisory","x_refsource_GENTOO"]}],"problemTypes":[{"descriptions":[{"description":"Type confusion in Array.pop","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"mozilla","dateUpdated":"2019-08-15T17:06:17.000Z","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@mozilla.org","ID":"CVE-2019-11707","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Firefox ESR","version":{"version_data":[{"version_affected":"<","version_value":"60.7.1"}]}},{"product_name":"Firefox","version":{"version_data":[{"version_affected":"<","version_value":"67.0.3"}]}},{"product_name":"Thunderbird","version":{"version_data":[{"version_affected":"<","version_value":"60.7.2"}]}}]},"vendor_name":"Mozilla"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Type confusion in Array.pop"}]}]},"references":{"reference_data":[{"name":"https://www.mozilla.org/security/advisories/mfsa2019-20/","refsource":"MISC","url":"https://www.mozilla.org/security/advisories/mfsa2019-20/"},{"name":"https://www.mozilla.org/security/advisories/mfsa2019-18/","refsource":"MISC","url":"https://www.mozilla.org/security/advisories/mfsa2019-18/"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","refsource":"MISC","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386"},{"name":"GLSA-201908-12","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201908-12"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201908-12","name":"GLSA-201908-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T23:03:32.447Z"}},{"title":"CISA ADP Vulnrichment","references":[{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2019-11707","role":"CISA Coordinator","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-07T12:49:50.350133Z"}}},{"other":{"type":"kev","content":{"dateAdded":"2022-05-23","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","lang":"en","type":"CWE","description":"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-10-21T23:45:33.091Z"},"timeline":[{"time":"2022-05-23T00:00:00.000Z","lang":"en","value":"CVE-2019-11707 added to CISA KEV"}]}]}}}