cve-2019-9793
Vulnerability from cvelistv5
Published
2019-04-26 16:13
Modified
2024-08-04 22:01
Severity ?
Summary
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
References
security@mozilla.orghttps://access.redhat.com/errata/RHSA-2019:0966
security@mozilla.orghttps://access.redhat.com/errata/RHSA-2019:1144
security@mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1528829Issue Tracking, Permissions Required, Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2019-07/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2019-08/Vendor Advisory
security@mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2019-11/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:0966
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:1144
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.mozilla.org/show_bug.cgi?id=1528829Issue Tracking, Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2019-07/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2019-08/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.mozilla.org/security/advisories/mfsa2019-11/Vendor Advisory
Impacted products
Vendor Product Version
Mozilla Thunderbird Version: unspecified   < 60.6
 Create a notification for this product.
   Mozilla Firefox ESR Version: unspecified   < 60.6
 Create a notification for this product.
   Mozilla Firefox Version: unspecified   < 66
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T22:01:54.816Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2019-07/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2019-08/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.mozilla.org/security/advisories/mfsa2019-11/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1528829",
               },
               {
                  name: "RHSA-2019:0966",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:0966",
               },
               {
                  name: "RHSA-2019:1144",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:1144",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Thunderbird",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.6",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox ESR",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "60.6",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
            {
               product: "Firefox",
               vendor: "Mozilla",
               versions: [
                  {
                     lessThan: "66",
                     status: "affected",
                     version: "unspecified",
                     versionType: "custom",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Improper bounds checks when Spectre mitigations are disabled",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-05-13T09:06:07",
            orgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
            shortName: "mozilla",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2019-07/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2019-08/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.mozilla.org/security/advisories/mfsa2019-11/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1528829",
            },
            {
               name: "RHSA-2019:0966",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:0966",
            },
            {
               name: "RHSA-2019:1144",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:1144",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@mozilla.org",
               ID: "CVE-2019-9793",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Thunderbird",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.6",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox ESR",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "60.6",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Firefox",
                                 version: {
                                    version_data: [
                                       {
                                          version_affected: "<",
                                          version_value: "66",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Mozilla",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Improper bounds checks when Spectre mitigations are disabled",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2019-07/",
                     refsource: "MISC",
                     url: "https://www.mozilla.org/security/advisories/mfsa2019-07/",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2019-08/",
                     refsource: "MISC",
                     url: "https://www.mozilla.org/security/advisories/mfsa2019-08/",
                  },
                  {
                     name: "https://www.mozilla.org/security/advisories/mfsa2019-11/",
                     refsource: "MISC",
                     url: "https://www.mozilla.org/security/advisories/mfsa2019-11/",
                  },
                  {
                     name: "https://bugzilla.mozilla.org/show_bug.cgi?id=1528829",
                     refsource: "MISC",
                     url: "https://bugzilla.mozilla.org/show_bug.cgi?id=1528829",
                  },
                  {
                     name: "RHSA-2019:0966",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:0966",
                  },
                  {
                     name: "RHSA-2019:1144",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:1144",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
      assignerShortName: "mozilla",
      cveId: "CVE-2019-9793",
      datePublished: "2019-04-26T16:13:22",
      dateReserved: "2019-03-14T00:00:00",
      dateUpdated: "2024-08-04T22:01:54.816Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2019-9793\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2019-04-26T17:29:01.850\",\"lastModified\":\"2024-11-21T04:52:19.240\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.\"},{\"lang\":\"es\",\"value\":\"Se encontró un mecanismo que elimina algunos límites para comprobar los accesos de cadenas, matrices o matrices escritas si se han deshabilitado las mitigaciones de Specter. Esta vulnerabilidad podría permitir a un atacante crear un valor arbitrario en JavaScript compilado, para el cual el análisis de rango inferirá un rango totalmente controlado e incorrecto en circunstancias donde los usuarios han inhabilitado explícitamente las mitigaciones de Spectre. * Nota: las configuraciones de Specter están actualmente habilitadas para todos los usuarios por la configuración por defecto. *. Esta vulnerabilidad inpacta a Thunderbird versión <60.6, Firefox ESR versión <60.6 y Firefox versión <66\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"66.0\",\"matchCriteriaId\":\"DF5B7642-9E9D-4578-9120-B95A6B198177\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"60.6\",\"matchCriteriaId\":\"7D949098-633D-43E4-AD71-7B017E7E9BDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"60.6\",\"matchCriteriaId\":\"AD62B1F4-1D76-4B74-9637-843D00E7F4FD\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2019:0966\",\"source\":\"security@mozilla.org\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1144\",\"source\":\"security@mozilla.org\"},{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1528829\",\"source\":\"security@mozilla.org\",\"tags\":[\"Issue Tracking\",\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2019-07/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2019-08/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2019-11/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:0966\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1144\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1528829\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Permissions Required\",\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2019-07/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2019-08/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2019-11/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.