Mozilla Firefox up to 67.0.2 Array.pop type conversion

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Mozilla Firefox up to 67.0.2. Affected is the function Array.pop. Performing a manipulation results in type conversion. This vulnerability is identified as CVE-2019-11707. The attack can be initiated remotely. Additionally, an exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Mozilla Firefox up to 67.0.2 (Web Browser). This affects the function Array.pop. The manipulation with an unknown input leads to a type conversion vulnerability. CWE is classifying the issue as CWE-704. The product does not correctly convert an object, resource, or structure from one type to a different type. This is going to have an impact on availability. The summary by CVE is:

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

The bug was discovered 04/15/2019. The weakness was released 06/18/2019 by Samuel Gross with Google Project Zero as MFSA 2019-18 as confirmed security advisory (Website). The advisory is shared at mozilla.org. The public release was coordinated with Mozilla. This vulnerability is uniquely identified as CVE-2019-11707 since 05/03/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known.

The exploit is shared for download at exploit-db.com. It is declared as attacked. The vulnerability was handled as a non-public zero-day exploit for at least 64 days. During that time the estimated underground price was around $5k-$25k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197500 (Ubuntu Security Notification for Firefox Vulnerability (USN-4020-1)). The CISA Known Exploited Vulnerabilities Catalog lists this issue since 05/23/2022 with a due date of 06/13/2022:

Apply updates per vendor instructions.

Upgrading to version 67.0.3 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (47038) and Zero-Day.cz (544). Further details are available at bugzilla.mozilla.org. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Mozilla Firefox up to 67.0.2
• Mozilla Firefox ESR up to 60.7.0

Productinfo

Type

• Web Browser

Vendor

• Mozilla

Name

• Firefox

Version

• 67.0.0
• 67.0.1
• 67.0.2

License

• open-source

Website

• Vendor: https://www.mozilla.org/
• Product: https://www.mozilla.org/en-US/firefox/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #73: Mozilla Firefox Type confusion in Array.pop (by misc)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion