Vulnerability in Mozilla Firefox
CVE-2019-17026
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird <…
EPSS: 0.562 (98.1th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Thunderbird — versions unspecified
CISA KEV (Known Exploited Vulnerabilities)
This CVE is on the CISA KEV catalog, added on . CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.
BOD 22-01 due date: .
Required action: Apply updates per vendor instructions.
Public proof-of-concept exploits
References
- www.mozilla.org/security/advisories/mfsa2020-04/ (x_refsource_MISC)
- www.mozilla.org/security/advisories/mfsa2020-03/ (x_refsource_MISC)
- bugzilla.mozilla.org/show_bug.cgi (x_refsource_MISC)
- GLSA-202003-02 (vendor-advisory, x_refsource_GENTOO)
- USN-4335-1 (vendor-advisory, x_refsource_UBUNTU)
- packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.ht… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-17026?
- CVE-2019-17026 is a vulnerability in Mozilla Firefox. Published 2020-03-02.
- Is CVE-2019-17026 known to be exploited?
- Yes. CVE-2019-17026 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating it is being actively exploited. 18 public proof-of-concept repositories are indexed.