{"id":"CVE-2019-9791","published":"2019-04-26T16:13:22Z","modified":"2024-08-04T22:01:54Z","title":"The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects…","vendor":"Mozilla","product":"Thunderbird","tier":"core","eol":null,"affectedVersions":[{"vendor":"Mozilla","product":"Thunderbird","versions":[">= unspecified, < 60.6"]},{"vendor":"Mozilla","product":"Firefox ESR","versions":[">= unspecified, < 60.6"]},{"vendor":"Mozilla","product":"Firefox","versions":[">= unspecified, < 66"]}],"description":{"text":"The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). This allows for possible arbitrary reading and writing of objects during an exploitable crash. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.","provenance":"source","from":"CVE.org"},"summary":{"text":"The type inference system in Mozilla Thunderbird's IonMonkey JIT compiler can produce type confusions between arbitrary objects when a constructor function is entered through on-stack replacement. An attacker who can get the affected code compiled and executed may be able to read and write arbitrary objects during an exploitable crash.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:23Z"},"cvss":null,"epss":{"score":0.19915,"percentile":0.97418,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.mozilla.org/security/advisories/mfsa2019-07/","tags":["x_refsource_MISC"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-08/","tags":["x_refsource_MISC"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2019-11/","tags":["x_refsource_MISC"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1530958","tags":["x_refsource_MISC"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0966","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2019:1144","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-19153","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19153","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46613,"url":"https://www.exploit-db.com/exploits/46613","title":"Spidermonkey - IonMonkey Type Inference is Incorrect for Constructors Entered via OSR","type":"dos","platform":"multiple","date":"2019-03-26","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-03-26"},"pocGithub":{"count":1,"skipped":0,"earliest":"2021-09-08","earliestUrl":"https://github.com/Sp0pielar/CVE-2019-9791","repos":[{"name":"Sp0pielar/CVE-2019-9791","url":"https://github.com/Sp0pielar/CVE-2019-9791","stars":2,"created":"2021-09-08"}]},"first":{"date":"2019-03-26","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46613"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-03-26","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46613); later: PoC-in-GitHub 2021-09-08","url":"https://www.exploit-db.com/exploits/46613","provenance":"source"},{"date":"2019-04-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-9791","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.48,"detail":"percentile 0.9742"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}