CVE-2019-9811: High severity thunderbird vulnerability
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
Other sources
As part of his winning Pwn2Own entry, Niklas Baumstark demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-9811?
CVE-2019-9811 is a vulnerability that allows a sandbox escape in Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
How can this vulnerability be exploited?
This vulnerability can be exploited by installing a malicious language pack and then opening a browser feature that uses the compromised translation.
Which software versions are affected by CVE-2019-9811?
Firefox ESR versions prior to 60.8, Firefox versions prior to 68, and Thunderbird versions prior to 60.8 are affected.
What is the severity of CVE-2019-9811?
CVE-2019-9811 has a severity rating of 8.3 (high).
Is there a fix available for CVE-2019-9811?
Yes, updating to Firefox ESR 60.8 or later, Firefox 68 or later, or Thunderbird 60.8 or later will fix the vulnerability.