Actively exploited · Published Mar 2, 2020 · Assigned by mozilla
CVE-2019-17026
High 8.8 Exploited
In plain English
A high-severity type confusion in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 46.3% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 68.4.1, Thunderbird < 68.4.1, and Firefox < 72.0.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.21 | firefox | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.22 | firefox | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.23 | firefox | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.20 | firefox-esr | 68.4.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.21 | firefox-esr | 68.4.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.22 | firefox-esr | 68.4.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.23 | firefox-esr | 68.4.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.21 | librewolf | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.22 | librewolf | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.23 | librewolf | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Alpine:v3.24 | librewolf | 71.0.1-r0 | ALPINE-CVE-2019-17026 |
| Debian:12 | firefox-esr | 68.4.1esr-1 | DEBIAN-CVE-2019-17026 |
| Debian:13 | firefox-esr | 68.4.1esr-1 | DEBIAN-CVE-2019-17026 |
| Debian:14 | firefox-esr | 68.4.1esr-1 | DEBIAN-CVE-2019-17026 |
| Debian:12 | thunderbird | 1:68.4.1-1 | DEBIAN-CVE-2019-17026 |
| Debian:13 | thunderbird | 1:68.4.1-1 | DEBIAN-CVE-2019-17026 |
| Debian:14 | thunderbird | 1:68.4.1-1 | DEBIAN-CVE-2019-17026 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox ESR | unspecified – before 68.4.1 |
| Mozilla | Thunderbird | unspecified – before 68.4.1 |
| Mozilla | Firefox | unspecified – before 72.0.1 |
Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.mozilla.org/security/advisories/mfsa2020-04/ x_refsource_MISC
- https://www.mozilla.org/security/advisories/mfsa2020-03/ x_refsource_MISC
- https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 x_refsource_MISC
- GLSA-202003-02 vendor-advisory, x_refsource_GENTOO
- USN-4335-1 vendor-advisory, x_refsource_UBUNTU
- http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17026 government-resource