What’s Vulnerable › Vulnerabilities

CVE-2019-9811

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-23 · updated 2026-06-17
• Weakness: CWE-74

Description

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Affected products

• Debian Linux: 8.0
• Mozilla Firefox: before 68.0 — fixed in 68.0
• Mozilla Firefox ESR: before 60.8 — fixed in 60.8
• Mozilla Thunderbird: before 60.8 — fixed in 60.8
• Novell Suse Package Hub For Suse Linux Enterprise: 12
• openSUSE Leap: 15.0, 15.1

How to fix

Upgrade to a fixed version: Mozilla Firefox 68.0; Mozilla Firefox ESR 60.8; Mozilla Thunderbird 60.8. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1538007
• https://bugzilla.mozilla.org/show_bug.cgi?id=1539598
• https://bugzilla.mozilla.org/show_bug.cgi?id=1563327
• https://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
• https://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
• https://security.gentoo.org/glsa/201908-12
• https://security.gentoo.org/glsa/201908-20

Get alerted when CVE-2019-9811 or the next vulnerability affects your stack