DEBIAN-CVE-2019-9810

DEBIAN-CVE-2019-9810 PUBLISHED CVSS 8.800000190734863 HIGH

Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.

Risk Scores

CVSS 3.1

8.800000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Debian:13	firefox-esr	0, 0, 0
Debian:12	firefox-esr	0, 0, 0
Debian:11	firefox-esr	0, 0, 0
Debian:14	firefox-esr	0, 0, 0

Exploit Intelligence

Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit. (github-poc-repo)
Exploit for CVE-2019-9810 Firefox on Windows 64-bit. (github-poc)
Array.prototype.slice wrong alias information. (github-poc)

Timeline

Apr 26, 2019 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2019-9810 advisory

Open in Interactive Console →