CVE-2019-11694
CVE-2019-11694
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.
CVSS 7.5 · High · EPSS 1.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
thunderbird
- Versions
- ≥ unspecified, < 60.7: Affected (custom)
Update to 60.7
firefox
- Versions
- ≥ unspecified, < 67: Affected (custom)
Update to 67
firefox esr
- Versions
- ≥ unspecified, < 60.7: Affected (custom)
Update to 60.7
mozjs52 Ubuntu:18.04:LTS
- Versions
- 52.3.1-0ubuntu3
- 52.3.1-7fakesync1
- 52.8.1-0ubuntu0.18.04.1
- 52.9.1-0ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs38 Ubuntu:18.04:LTS
- Versions
- 38.8.0~repack1-0ubuntu1
- 38.8.0~repack1-0ubuntu3
- 38.8.0~repack1-0ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mozjs52 Ubuntu:20.04:LTS
- Versions
- 52.9.1-1build1
- 52.9.1-1ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published