CVE-2019-11707
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Description
CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox and Thunderbird that occurs when manipulating JavaScript objects due to issues in the Array.pop method. This flaw can lead to an exploitable crash and potentially allow remote code execution when a user visits a malicious website or opens a crafted email in Thunderbird. CISA has confirmed active exploitation and added CVE-2019-11707 to the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 99.3%, this vulnerability is among the most actively exploited browser flaws and was notably chained with CVE-2019-11708 for a complete sandbox escape attack.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 60.7.1; < 67.0.3 |
| mozilla | thunderbird | < 60.7.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1544386(Issue Tracking, Permissions Required, Vendor Advisory)
- https://security.gentoo.org/glsa/201908-12(Third Party Advisory)
- https://www.mozilla.org/security/advisories/mfsa2019-18/(Vendor Advisory)
- https://www.mozilla.org/security/advisories/mfsa2019-20/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type (Type Confusion)
CWE-843 describes a weakness where a program accesses a resource using a type that is incompatible with the actual type of the resource, leading to undefined behavior that can be exploited. In CVE-2019-11707, Firefox's JavaScript engine incorrectly handles type information during Array.pop operations, causing it to treat an object as a different type than its actual type, which enables memory corruption and arbitrary code execution.
Learn more: CWE-843 — Access of Resource Using Incompatible Type (Type Confusion)
Impact Analysis
CVE-2019-11707 is a type confusion vulnerability in Mozilla Firefox and Thunderbird's JavaScript engine that enables remote code execution. The attack is network-based and can be triggered when a user simply visits a malicious web page in Firefox or opens a crafted email containing JavaScript in Thunderbird. No authentication or special privileges are required. Successful exploitation allows an attacker to execute arbitrary code within the browser's content process, compromising the confidentiality, integrity, and availability of data accessible from that context. The EPSS percentile of 99.3% confirms extremely high real-world exploitation activity. This vulnerability is particularly dangerous because it was observed being chained with CVE-2019-11708, a sandbox escape vulnerability, allowing attackers to break out of Firefox's content process sandbox and achieve full system-level code execution. The dual impact on both Firefox and Thunderbird expands the attack surface to include email-based delivery vectors.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-11707 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 99.3% places this vulnerability among the most actively exploited browser flaws in existence. Mozilla acknowledged that CVE-2019-11707 was exploited in targeted attacks in the wild, confirming its zero-day status at the time of discovery. The vulnerability was notably used in conjunction with CVE-2019-11708 (a sandbox escape flaw) in a sophisticated attack chain targeting cryptocurrency companies — the type confusion provided initial code execution in the renderer, while the sandbox escape allowed full system compromise. This chaining demonstrates the severity of CVE-2019-11707 as a first-stage exploit in real-world targeted operations against high-value targets.
Remediation
- Update Mozilla Firefox to version 67.0.3 or later and Firefox ESR to version 60.7.1 or later. Update Thunderbird to version 60.7.2 or later. These versions contain the official fix for CVE-2019-11707.
- Enable automatic updates in Firefox and Thunderbird to ensure timely delivery of security patches. In enterprise environments, use policies to enforce minimum version requirements.
- Disable JavaScript in Thunderbird if it is not required for email functionality, as this eliminates the primary attack vector for type confusion vulnerabilities in the email client.
- Deploy network-level protections including web content filtering and email gateway security to block delivery of exploit payloads targeting this vulnerability.
- Monitor for indicators of compromise associated with the cryptocurrency-targeting campaign that leveraged CVE-2019-11707 and CVE-2019-11708, including unusual process spawning from Firefox or Thunderbird and connections to known command-and-control infrastructure.
Technical Details
CVE-2019-11707 is a type confusion vulnerability in Mozilla's SpiderMonkey JavaScript engine, specifically in the handling of the Array.pop method. The flaw occurs when the JIT (Just-In-Time) compiler makes incorrect assumptions about the type of elements stored in a JavaScript array during Array.pop operations. When certain conditions are met through carefully crafted JavaScript code, the engine processes an array element as a different type than it actually is — for example, treating an object pointer as an integer or vice versa. This type confusion leads to memory corruption because the engine applies incorrect size, alignment, or interpretation rules to the mistyped data. An attacker can exploit this to achieve controlled memory reads and writes, which can then be leveraged to construct a full exploit chain achieving arbitrary code execution within the Firefox or Thunderbird content process. The vulnerability affects both the browser (triggered via web content) and the email client (triggered via HTML email with JavaScript), making it exploitable through multiple delivery vectors.
Frequently Asked Questions
Is CVE-2019-11707 being actively exploited?
Yes, CVE-2019-11707 was exploited as a zero-day in targeted attacks against cryptocurrency companies. CISA has included it in the KEV catalog, and its EPSS percentile of 99.3% confirms it is among the most exploited browser vulnerabilities. It was chained with CVE-2019-11708 for full system compromise.
What products are affected by CVE-2019-11707?
CVE-2019-11707 affects Mozilla Firefox (versions before 67.0.3), Firefox ESR (versions before 60.7.1), and Mozilla Thunderbird (versions before 60.7.2). Both the browser and email client are vulnerable due to the shared SpiderMonkey JavaScript engine.
How do I fix CVE-2019-11707?
Update Firefox to version 67.0.3+, Firefox ESR to 60.7.1+, or Thunderbird to 60.7.2+. Enable automatic updates and consider disabling JavaScript in Thunderbird if not needed. Enterprise administrators should enforce minimum version requirements through policies.
How severe is CVE-2019-11707?
CVE-2019-11707 is a critical type confusion vulnerability with an EPSS percentile of 99.3%. It was used as a zero-day in sophisticated targeted attacks and, when chained with CVE-2019-11708, enabled complete system compromise. Immediate patching is essential for all Firefox and Thunderbird users.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.