{"schemaVersion":3,"id":"MGASA-2020-0009","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Updated mozjs60 packages fix security vulnerability\n\nThe updated packages fix security vulnerabilities:\n\nA type confusion vulnerability can occur when manipulating JavaScript\nobjects due to issues in Array.pop. This can allow for an exploitable\ncrash. We are aware of targeted attacks in the wild abusing this flaw.\nThis vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3,\nand Thunderbird < 60.7.2. (CVE-2019-11707)\n\nInsufficient vetting of parameters passed with the Prompt:Open IPC message\nbetween child and parent processes can result in the non-sandboxed parent\nprocess opening web content chosen by a compromised child process. When\ncombined with additional vulnerabilities this could result in executing\narbitrary code on the user's computer. This vulnerability affects Firefox\nESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. (CVE-2019-11708)\n\nThe mozjs60 package has been updated to version 60.9.0, fixing these issues\nand other bugs. The gjs package has been rebuilt against the updated mozjs60.","dates":{"published":"2020-01-05T15:37:51.000Z","modified":"2026-04-16T04:42:04.745Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"mageia","product":"gjs","name":"gjs","label":"gjs","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/gjs","purlType":"rpm","versions":[{"text":"< 1.56.2-1.1.mga7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.56.2-1.1.mga7","eol":null,"hubHref":null},{"vendor":"mageia","product":"mozjs60","name":"mozjs60","label":"mozjs60","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/mozjs60","purlType":"rpm","versions":[{"text":"< 60.9.0-1.mga7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 60.9.0-1.mga7","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://advisories.mageia.org/MGASA-2020-0009.html","label":"advisories.mageia.org/MGASA-2020-0009.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25910","label":"bugs.mageia.org/show_bug.cgi?id=25910","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/OS4TDQ75LLRCFOAXMPHTQE6XCPJGZQ6X/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZS2X4UWVWTNTNWOCAJYQO77GGSSI3H6K/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["WEB"]}],"lineage":{"upstream":["CVE-2019-11707","CVE-2019-11708"],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-01-05T15:37:51.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-16T04:42:04.745Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T00:50:38.797Z","stale":false,"partial":false}}