VDB

CVE-2019-9816

CVE-2019-9816 PUBLISHED CVSS 5.900000095367432 MEDIUM

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

EPSS 6.15% · 93.3th percentile

Risk Scores

CVSS 3.0
5.900000095367432
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
6.15%
93.3th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSthunderbird*, 1:60.6.1+build2-0ubuntu0.18.04.1, 0
Ubuntu:18.04:LTSmozjs5252.9.1-0ubuntu0.18.04.1, 0, 52.3.1-0ubuntu3
Ubuntu:20.04:LTSmozjs520, 52.9.1-1ubuntu3, 52.9.1-1build1
Ubuntu:18.04:LTSmozjs380, *, *
Ubuntu:16.04:LTSthunderbird1:52.4.0+build1-0ubuntu0.16.04.2, 1:52.5.0+build1-0ubuntu0.16.04.1, 1:52.6.0+build1-0ubuntu0.16.04.1
Ubuntu:16.04:LTSfirefox62.0+build2-0ubuntu0.16.04.5, 62.0.3+build1-0ubuntu0.16.04.2, 63.0.3+build1-0ubuntu0.16.04.1
Ubuntu:18.04:LTSfirefox0, 57.0.1+build2-0ubuntu1, 59.0.1+build1-0ubuntu1

Timeline

  • May 21, 2019 CVE Published
  • May 28, 2019 PoC Published
  • Apr 14, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Dec 29, 2021 EPSS Score
  • Mar 2, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • Jul 6, 2022 EPSS Score
  • Nov 9, 2022 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 22, 2023 EPSS Score
  • May 27, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›