Home

CVE-2019-11694

Description

A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.398

Associated Vulnerability

VulnerabilityOS Platform
Multiple Vulnerabilities are affected in Mozilla Firefox 66.0.5Windows
Multiple Vulnerabilities are affected in Firefox ESR for Mac 60.6.3Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 60.6.3Mac
Multiple Vulnerabilities are affected in Mozilla Firefox for Mac 66.0.5Mac
Multiple Vulnerabilities are affected in Mozilla Thunderbird for Mac 60.6.1Mac
SUSE-SU-2019:1388-1(SUSE Linux Enterprise Desktop 12-SP3 ) MozillaFirefox-60.7.0-109.72.1.x86_64.rpmLinux
SUSE-SU-2019:1388-1(SUSE Linux Enterprise Desktop 12-SP3 ) MozillaFirefox-debuginfo-60.7.0-109.72.1.x86_64.rpmLinux
SUSE-SU-2019:1388-1(SUSE Linux Enterprise Desktop 12-SP3 ) MozillaFirefox-debugsource-60.7.0-109.72.1.x86_64.rpmLinux
SUSE-SU-2019:1388-1(SUSE Linux Enterprise Desktop 12-SP3 ) MozillaFirefox-translations-common-60.7.0-109.72.1.x86_64.rpmLinux

Patch Details

Click to see the patches provided by ManageEngine for this CVE
Patch IDPatch Description
PATCH-343015Mozilla Firefox (132.0.2)
PATCH-611808Mozilla Firefox ESR for MAC 128.14.0
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611870Mozilla Firefox For Mac (142.0.1)
PATCH-611807Mozilla Thunderbird For Mac (142.0)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234