CVE-2019-17026

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.

Affected products

Alt Linux, Centos, Firefox, Firefox Esr, Red Hat, Suse, Thunderbird, Ubuntu

Mozilla Firefox

< 68.4.1, 72.0.1

Mozilla Thunderbird

< 68.4.1

Fix

Available

CVSS 3.1

8.8 HIGH

EPSS

46.6% (99th percentile)

Weakness

CWE-843

NVD status

Analyzed

Published

2020-03-02