8.8

CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerability

CVSS: 8.8v3.1HighKEVAnalyzed
AliasesALPINE-CVE-2019-11707MGASA-2019-0198SUSE-RU-2019:1625-1
Published 23-07-2019Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2019-11707 is a high (CVSS 8.8) Type Confusion vulnerability in Mozilla Firefox and Thunderbird. It is known to be exploited: CISA lists it, first on 23-05-2022. EPSS estimates a 37.70% chance of exploitation in the next 30 days, higher than 98.5% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
37.70%
0%100%
High · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2exploit-database

Advisory lineage

Upstream 0 · Downstream 18 · Related 8
DLA-1836-1DSA-4471-1MGASA-2019-0201MGASA-2020-0009OPENSUSE-SU-2019:1606-1OPENSUSE-SU-2019:1664-1

Timeline

  1. 23-07-2019
    PublishedVulnerability first disclosed.
  2. 23-05-2022
    Added to CISA KEVMozilla Firefox and Thunderbird Type Confusion Vulnerability
  3. 13-06-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

37.70%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 37.70% on 18-09-2026

18-09-202618-10-2026
EPSS score
37.70%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
23-05-2022
Federal due date
13-06-2022

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-11707

Public exploits

2 found
  • exploit-databasedosmultipleVerified

    Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion

    Maturity: poc

  • exploit-databaselocalwindowsUnverified

    Mozilla Firefox 67 - Array.pop JIT Type Confusion

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Suse18 products
  • MozillaFirefox&distro=SUSE Enterprise Storage 4< 60.7.1-109.77.1
  • MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP3< 60.7.1-109.77.1
  • MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP4< 60.7.1-109.77.1
  • MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15< 60.7.1-3.45.1
  • MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 60.7.1-3.45.1
Mozilla3 products
Debian2 products
  • firefox-esr< 60.7.1esr-1 | < 60.7.1esr-1~deb9u1 | < 60.7.1esr-1~deb8u1
  • thunderbird< 1:60.7.2-1
Mageia2 products
  • firefox< 60.7.1-1.mga6
  • firefox-l10n< 60.7.1-1.mga6
Ubuntu2 products
  • firefox< 67.0.3+build1-0ubuntu0.16.04.1 | < 67.0.3+build1-0ubuntu0.18.04.1
  • mozjs52All versions (No fix recorded)
Alpine1 product
  • mozjs60< 60.7.2-r0
Opensuse1 product
  • MozillaFirefox&distro=openSUSE Leap 15.0< 60.7.2-lp150.3.59.1

7 vendors · 29 products

References

23 links
Show all 23 references