← Back to browse · API

CVE-2019-11707

Severity
HIGH
CVSS
8.8
EPSS
0.37951
Risk score
73.48
CISA KEV
Yes
PoC
No
Published
2019-07-23
Modified
2025-10-21
First seen
2026-08-07
Aliases
EUVD-2019-3377, GHSA-8FFR-Q7J8-H445
Products
Mozilla:Firefox ESR unspecified <60.7.1, Mozilla:Firefox and Thunderbird, Mozilla:Firefox unspecified <67.0.3, Mozilla:Thunderbird unspecified <60.7.2
Sources
cisa.gov CVE-2019-11707
euvd EUVD-2019-3377

Description

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

References