The vulnerability of the API XMLHttpRequest component in browsers such as Firefox, Firefox ESR, and the email client Thunderbird lies in its memory management after it is freed. This allows attackers to compromise data integrity, gain unauthorized access to protected information, and cause service failures.

🗓️ 16 Oct 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

XMLHttpRequest memory after free in Firefox and Thunderbird enables data access, integrity breach.

Reporter	Title	Published	Views	Family All 165
IBM Security Bulletins	Security Bulletin: WebSphere Cast Iron and App Connect Professional are affected by vulnerabilities in busybox, arpwatch, apr, acpid, augeas, firefox, ctdb.	15 Dec 202107:41	–	ibm
IBM Security Bulletins	Security Bulletin: Synthetic Playback Agent 8.1.x is affected by multiple vulnerabilities	8 Aug 201909:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Mozilla Firefox vulnerability in IBM SONAS	8 Jul 201908:00	–	ibm
FreeBSD	mozilla -- multiple vulnerabilities	21 May 201900:00	–	freebsd
Tenable Nessus	Mozilla Firefox < 67.0 Multiple Vulnerabilities	21 May 201900:00	–	nessus
Tenable Nessus	Mozilla Firefox ESR < 60.7 Multiple Vulnerabilities	21 May 201900:00	–	nessus
Tenable Nessus	Mozilla Thunderbird < 60.7 Multiple Vulnerabilities	21 May 201600:00	–	nessus
Tenable Nessus	Amazon Linux 2 : thunderbird (ALAS-2019-1229)	14 Jun 201900:00	–	nessus
Tenable Nessus	CentOS 8 : firefox (CESA-2019:1269)	29 Jan 202100:00	–	nessus
Tenable Nessus	CentOS 8 : thunderbird (CESA-2019:1308)	29 Jan 202100:00	–	nessus

Vulners

Node

mozilla firefoxRange<67

OR

mozilla firefox_esrRange<60.7

OR

mozilla thunderbirdRange<60.7

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

red_hat red_hat_enterprise_linuxMatch8

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-11691
security-tracker	www.security-tracker.debian.org/tracker/CVE-2019-11691
mozilla	www.mozilla.org/en-US/security/advisories/mfsa2019-15/
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
wiki	www.wiki.astralinux.ru/pages/viewpage.action
web	www.web.nvd.nist.gov/view/vuln/detail

23 Mar 2021 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 39.8

CVSS 210

EPSS0.00732

XMLHttpRequest memory after free Firefox Thunderbird data access integrity breach