CVE-2019-11757: Use After Free
A use-after-free flaw was found in Mozilla Firefox and Thunderbird. When following a value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. An attacker could use this flaw to execute code that was stored in the referenced memory or crash the system.
Other sources
When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash.
— Mozilla
When storing a value in IndexedDB, the value's prototype chain is followed and it was possible to retain a reference to a locale, delete it, and subsequently reference it. This resulted in a use-after-free and a potentially exploitable crash.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is vulnerability CVE-2019-11757?
Vulnerability CVE-2019-11757 is a use-after-free flaw found in Mozilla Firefox and Thunderbird.
What is the severity of vulnerability CVE-2019-11757?
The severity of vulnerability CVE-2019-11757 is high with a severity value of 8.8.
Which software is affected by vulnerability CVE-2019-11757?
Vulnerability CVE-2019-11757 affects Mozilla Firefox and Thunderbird versions 68.2.0-4.el6_10, 68.2.0-2.el6_10, 68.2.0-1.el7_7, 68.2.0-1.el8_0, and Firefox ESR 68.2.
How can an attacker exploit vulnerability CVE-2019-11757?
An attacker can exploit vulnerability CVE-2019-11757 to execute code stored in referenced memory or cause a crash.
Where can I find more information about vulnerability CVE-2019-11757?
You can find more information about vulnerability CVE-2019-11757 in the following references: [Reference 1](https://bugzilla.mozilla.org/show_bug.cgi?id=1577107), [Reference 2](https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/), [Reference 3](https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/).