CVE-2019-17026

CVE-2019-17026 describes a type-confusion vulnerability in the IonMonkey JIT used by Mozilla products. The issue stems from incorrect alias information when storing array elements, enabling a type confusion that could be exploited for arbitrary code execution. Affected products include Firefox ES...

CVE-2019-17026

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR 68.4.1, Thunderbird 68.4.1, and Firefox 72.0.1. Recent assessments: gwillcox-r7 a...

Google Chrome 67, 68 and 69 Object.create exploit

This modules exploits a type confusion in Google Chromes JIT compiler. The Object.create operation can be used to cause a type confusion between a PropertyArray and a NameDictionary. The payload is executed within the rwx region of the sandboxed renderer process. This module can target the render...

Important: thunderbird

Issue Overview: When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR tag from the clipboard into...

Arbitrary Code Execution

mozilla firefox is vulnerable to arbitrary code execution. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion...

Mozilla Thunderbird Security Advisory (MFSA2020-04) - Windows

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla Thunderbird < 68.4.1

The version of Thunderbird installed on the remote Windows host is prior to 68.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-04 advisory. - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. ...

MGASA-2020-0027 Updated firefox packages fix security vulnerability

When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration CVE-2019-17016. Due to a missing case handling object types, a type confusion...

[slackware-security] mozilla-firefox

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-firefox-68.4.1esr-i686-1slack14.2.txz: Upgraded. This release fixes a critial security issue: Mozilla Foundation...

Mozilla Firefox Security Advisories (MFSA2020-03, MFSA2020-03) - Mac OS X

Mozilla Firefox is prone to type confusion vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Mozilla Firefox < 72.0.1

The version of Firefox installed on the remote Windows host is prior to 72.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-03 advisory. - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware ...

Mozilla Firefox ESR < 68.4.1

The version of Firefox ESR installed on the remote Windows host is prior to 68.4.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-03 advisory. - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are...

Mozilla Firefox ESR < 68.4.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.4.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2020-03 advisory. - Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion...

Exploit for Integer Overflow or Wraparound in Apple Icloud

Exploiting CVE-2019-8601 This is an exploit for a WebKit vuln...

JavaScriptCore GetterSetter Type Confusion

JSC: GetterSetter type confusion during DFG compilation The following JavaScript program, found by Fuzzilli and slightly modified, crashes JavaScriptCore built from HEAD and the current stable release /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc: let notAGetterSetter =...

JavaScriptCore - GetterSetter Type Confusion During DFG Compilation Exploit

The following JavaScript program, found by Fuzzilli and slightly modified, crashes JavaScriptCore built from HEAD and the current stable release /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc: let notAGetterSetter = whatever: 42; function v2v5 const v10 = Object; if v5 const v1...

CVE-2018-12549

In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler may incorrectly omit a null check on the receiver object of an Unsafe call when accelerating it...

CVE-2018-12387

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content...

Microsoft Windows jscript9 RegExp.input Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way the JIT...

NewStart CGSL CORE 5.04 / MAIN 5.04 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0062)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has thunderbird packages installed that are affected by multiple vulnerabilities: - Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory...