{"schemaVersion":3,"id":"CVE-2019-11707","aliases":["ALPINE-CVE-2019-11707","MGASA-2019-0198","SUSE-RU-2019:1625-1","SUSE-SU-2019:1629-1","UBUNTU-CVE-2019-11707","USN-4020-1","DEBIAN-CVE-2019-11707","DLA-1829-1","DSA-4466-1","openSUSE-SU-2019:1593-1"],"status":"published","duplicateOf":null,"title":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","description":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.","dates":{"published":"2019-07-23T13:20:17.000Z","modified":"2025-10-21T23:45:33.091Z","reserved":null,"kevAdded":["2022-05-23T00:00:00.000Z"],"kevDue":["2022-06-13T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":8.8,"severity":"high","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true}]},"epss":{"probability":0.37696,"percentile":0.98529,"severity":"high","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.37696},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.37696,"percentile":0.98529}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.37696,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.37696,"percentile":0.98529}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-23T00:00:00.000Z","dueDate":"2022-06-13T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","description":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2019-11707","label":"nvd.nist.gov/vuln/detail/CVE-2019-11707"}],"vendor":"Mozilla","product":"Firefox and Thunderbird","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-23T00:00:00.000Z","dueDate":"2022-06-13T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","description":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2019-11707","label":"nvd.nist.gov/vuln/detail/CVE-2019-11707"}],"vendor":"Mozilla","product":"Firefox and Thunderbird","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"47038","name":"Mozilla Spidermonkey - IonMonkey 'Array.prototype.pop' Type Confusion","source":"exploit-database","url":"https://www.exploit-db.com/exploits/47038","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":"dos","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"dos","platform":"multiple","file":"exploits/multiple/dos/47038.txt","codes":["CVE-2019-11707"]},"metasploit":null},{"id":"50691","name":"Mozilla Firefox 67 - Array.pop JIT Type Confusion","source":"exploit-database","url":"https://www.exploit-db.com/exploits/50691","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"local","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"local","platform":"windows","file":"exploits/windows/local/50691.txt","codes":["CVE-2019-11707"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type ('Type Confusion')","description":"The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/843.html"}],"affected":[{"vendor":"alpine","product":"mozjs60","name":"mozjs60","label":"mozjs60","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/mozjs60","purlType":"apk","versions":[{"text":"< 60.7.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.2-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"firefox-esr","name":"firefox-esr","label":"firefox-esr","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/firefox-esr","purlType":"deb","versions":[{"text":"< 60.7.1esr-1","noFixRecorded":false,"fixedIn":null},{"text":"< 60.7.1esr-1~deb9u1","noFixRecorded":false,"fixedIn":null},{"text":"< 60.7.1esr-1~deb8u1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1esr-1 | < 60.7.1esr-1~deb9u1 | < 60.7.1esr-1~deb8u1","eol":null,"hubHref":null},{"vendor":"debian","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/thunderbird","purlType":"deb","versions":[{"text":"< 1:60.7.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:60.7.2-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/firefox","purlType":"deb","versions":[{"text":"< 67.0.3+build1-0ubuntu0.16.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 67.0.3+build1-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 67.0.3+build1-0ubuntu0.16.04.1 | < 67.0.3+build1-0ubuntu0.18.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"mozjs52","name":"mozjs52","label":"mozjs52","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/mozjs52","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"mageia","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/firefox","purlType":"rpm","versions":[{"text":"< 60.7.1-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-1.mga6","eol":null,"hubHref":null},{"vendor":"mageia","product":"firefox-l10n","name":"firefox-l10n","label":"firefox-l10n","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/firefox-l10n","purlType":"rpm","versions":[{"text":"< 60.7.1-1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-1.mga6","eol":null,"hubHref":null},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 67.0.3","noFixRecorded":false,"fixedIn":null},{"text":"< 60.7.1","noFixRecorded":false,"fixedIn":null},{"text":"< 67.0.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 67.0.3 | < 60.7.1 | < 67.0.3","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"firefox_esr","name":"firefox esr","label":"firefox_esr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 60.7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 60.7.1","eol":null,"hubHref":"/vendor/mozilla/firefox_esr"},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 60.7.2","noFixRecorded":false,"fixedIn":null},{"text":"< 60.7.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 60.7.2 | < 60.7.2","eol":null,"hubHref":"/vendor/mozilla/thunderbird"},{"vendor":"opensuse","product":"MozillaFirefox&distro=openSUSE Leap 15.0","name":"MozillaFirefox","label":"MozillaFirefox&distro=openSUSE Leap 15.0","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE Leap 15.0","purlType":"rpm","versions":[{"text":"< 60.7.2-lp150.3.59.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.2-lp150.3.59.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Enterprise Storage 4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Enterprise Storage 4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Enterprise Storage 4","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP3","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Desktop 12 SP4","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15","purlType":"rpm","versions":[{"text":"< 60.7.1-3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","purlType":"rpm","versions":[{"text":"< 60.7.1-3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP1-LTSS","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP1-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP1-LTSS","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2-BCL","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2-BCL","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2-BCL","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2-LTSS","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP2-LTSS","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP3","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP4","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12-LTSS","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server 12-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server 12-LTSS","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP1","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP3","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP4","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE Linux Enterprise Software Development Kit 12 SP4","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null},{"vendor":"suse","product":"MozillaFirefox&distro=SUSE OpenStack Cloud 7","name":"MozillaFirefox","label":"MozillaFirefox&distro=SUSE OpenStack Cloud 7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/MozillaFirefox&distro=SUSE OpenStack Cloud 7","purlType":"rpm","versions":[{"text":"< 60.7.1-109.77.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.7.1-109.77.1","eol":null,"hubHref":null}],"affectedCount":29,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/","label":"www.mozilla.org/security/advisories/mfsa2019-20/","hostname":"www.mozilla.org","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/","label":"www.mozilla.org/security/advisories/mfsa2019-18/","hostname":"www.mozilla.org","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","label":"bugzilla.mozilla.org/show_bug.cgi?id=1544386","hostname":"bugzilla.mozilla.org","tags":["X Refsource MISC","Issue Tracking","Permissions Required","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201908-12","label":"security.gentoo.org/glsa/201908-12","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-11707","label":"security.alpinelinux.org/vuln/CVE-2019-11707","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0198.html","label":"advisories.mageia.org/MGASA-2019-0198.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24976","label":"bugs.mageia.org/show_bug.cgi?id=24976","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/firefox/60.7.1/releasenotes/","label":"www.mozilla.org/en-US/firefox/60.7.1/releasenotes/","hostname":"www.mozilla.org","tags":["WEB"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/","label":"www.mozilla.org/en-US/security/advisories/mfsa2019-18/","hostname":"www.mozilla.org","tags":["Advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2019-1625/suse-ru-20191625-1/","label":"www.suse.com/support/update/announcement/-2019-1625/suse-ru-20191625-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1137792","label":"bugzilla.suse.com/1137792","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1138614","label":"bugzilla.suse.com/1138614","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11707","label":"www.suse.com/security/cve/CVE-2019-11707","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191629-1/","label":"www.suse.com/support/update/announcement/2019/suse-su-20191629-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11707","label":"ubuntu.com/security/CVE-2019-11707","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/#CVE-2019-11707","label":"www.mozilla.org/en-US/security/advisories/mfsa2019-18/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-4020-1","label":"ubuntu.com/security/notices/USN-4020-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4045-1","label":"ubuntu.com/security/notices/USN-4045-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11707","label":"www.cve.org/CVERecord?id=CVE-2019-11707","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11707","label":"security-tracker.debian.org/tracker/CVE-2019-11707","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AVI7KKW6DTGF6PJHZEXDKEANATAFIDY5/#AVI7KKW6DTGF6PJHZEXDKEANATAFIDY5","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-1836-1","DSA-4471-1","MGASA-2019-0201","MGASA-2020-0009","OPENSUSE-SU-2019:1606-1","OPENSUSE-SU-2019:1664-1","OPENSUSE-SU-2024:10600-1","OPENSUSE-SU-2024:10601-1","OPENSUSE-SU-2024:14572-1","RHSA-2019:1603","RHSA-2019:1604","RHSA-2019:1623","RHSA-2019:1624","RHSA-2019:1626","RHSA-2019:1696","SUSE-SU-2019:14124-1","SUSE-SU-2019:1683-1","USN-4045-1"],"duplicates":[],"related":["OPENSUSE-SU-2019:1606-1","OPENSUSE-SU-2019:1664-1","OPENSUSE-SU-2024:10600-1","OPENSUSE-SU-2024:10601-1","OPENSUSE-SU-2024:14572-1","SUSE-SU-2019:14124-1","SUSE-SU-2019:1683-1","USN-4045-1"]},"timeline":[{"kind":"published","date":"2019-07-23T13:20:17.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-23T00:00:00.000Z","label":"Added to CISA KEV","detail":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-13T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:45:33.091Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:45:24.616Z","stale":false,"partial":false}}