Vulnerability Description
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create an arbitrary value in compiled JavaScript, for which the range analysis will infer a fully controlled, incorrect range in circumstances where users have explicitly disabled Spectre mitigations. *Note: Spectre mitigations are currently enabled for all users by default settings.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 66.0 |
| Mozilla | Firefox Esr | < 60.6 |
| Mozilla | Thunderbird | < 60.6 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2019:0966
- https://access.redhat.com/errata/RHSA-2019:1144
- https://bugzilla.mozilla.org/show_bug.cgi?id=1528829Issue TrackingPermissions RequiredVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-07/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-08/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-11/Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:0966
- https://access.redhat.com/errata/RHSA-2019:1144
- https://bugzilla.mozilla.org/show_bug.cgi?id=1528829Issue TrackingPermissions RequiredVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-07/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-08/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-11/Vendor Advisory
FAQ
What is CVE-2019-9793?
CVE-2019-9793 is a vulnerability with a CVSS score of 5.9 (MEDIUM). A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. This vulnerability could allow an attacker to create ...
How severe is CVE-2019-9793?
CVE-2019-9793 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9793?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird.