CVE Vulnerabilities

CVE-2019-9813

Access of Resource Using Incompatible Type ('Type Confusion')

Published: Apr 26, 2019 | Modified: Aug 24, 2020
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
6.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
8.8 CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.

Weakness

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Affected Software

Name Vendor Start Version End Version
Firefox Mozilla * 66.0.1 (excluding)
Firefox_esr Mozilla * 60.6.1 (excluding)
Thunderbird Mozilla * 60.6.1 (excluding)
Red Hat Enterprise Linux 6 RedHat firefox-0:60.6.1-1.el6_10 *
Red Hat Enterprise Linux 6 RedHat thunderbird-0:60.6.1-1.el6_10 *
Red Hat Enterprise Linux 7 RedHat firefox-0:60.6.1-1.el7_6 *
Red Hat Enterprise Linux 7 RedHat thunderbird-0:60.6.1-1.el7_6 *
Red Hat Enterprise Linux 8 RedHat firefox-0:60.6.1-1.el8 *
Red Hat Enterprise Linux 8 RedHat thunderbird-0:60.6.1-1.el8 *
Firefox Ubuntu bionic *
Firefox Ubuntu cosmic *
Firefox Ubuntu devel *
Firefox Ubuntu disco *
Firefox Ubuntu eoan *
Firefox Ubuntu focal *
Firefox Ubuntu groovy *
Firefox Ubuntu hirsute *
Firefox Ubuntu impish *
Firefox Ubuntu jammy *
Firefox Ubuntu kinetic *
Firefox Ubuntu lunar *
Firefox Ubuntu mantic *
Firefox Ubuntu noble *
Firefox Ubuntu trusty *
Firefox Ubuntu upstream *
Firefox Ubuntu xenial *
Mozjs38 Ubuntu bionic *
Mozjs38 Ubuntu esm-apps/bionic *
Mozjs38 Ubuntu upstream *
Mozjs52 Ubuntu bionic *
Mozjs52 Ubuntu cosmic *
Mozjs52 Ubuntu disco *
Mozjs52 Ubuntu eoan *
Mozjs52 Ubuntu esm-apps/focal *
Mozjs52 Ubuntu esm-infra/bionic *
Mozjs52 Ubuntu focal *
Mozjs52 Ubuntu groovy *
Mozjs52 Ubuntu upstream *
Mozjs60 Ubuntu cosmic *
Mozjs60 Ubuntu disco *
Mozjs60 Ubuntu eoan *
Mozjs60 Ubuntu upstream *
Thunderbird Ubuntu bionic *
Thunderbird Ubuntu cosmic *
Thunderbird Ubuntu devel *
Thunderbird Ubuntu disco *
Thunderbird Ubuntu eoan *
Thunderbird Ubuntu focal *
Thunderbird Ubuntu groovy *
Thunderbird Ubuntu hirsute *
Thunderbird Ubuntu impish *
Thunderbird Ubuntu jammy *
Thunderbird Ubuntu kinetic *
Thunderbird Ubuntu lunar *
Thunderbird Ubuntu mantic *
Thunderbird Ubuntu noble *
Thunderbird Ubuntu trusty *
Thunderbird Ubuntu upstream *
Thunderbird Ubuntu xenial *

Extended Description

When the product accesses the resource using an incompatible type, this could trigger logical errors because the resource does not have expected properties. In languages without memory safety, such as C and C++, type confusion can lead to out-of-bounds memory access. While this weakness is frequently associated with unions when parsing data with many different embedded object types in C, it can be present in any application that can interpret the same variable or memory location in multiple ways. This weakness is not unique to C and C++. For example, errors in PHP applications can be triggered by providing array parameters when scalars are expected, or vice versa. Languages such as Perl, which perform automatic conversion of a variable of one type when it is accessed as if it were another type, can also contain these issues.

References