Type Confusion Vulnerability in mozjs60 Package: Exploitable Crash Risk
Summary
ALPINE-CVE-2019-11707: A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. Affects mozjs60 versions < 60.7.2-r0. Fixed in 60.7.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The mozjs60 package is a JavaScript engine used in various applications, including Firefox and Thunderbird. It enables the execution of JavaScript code and provides essential functionalities for web applications. However, it has been identified as vulnerable to a type confusion issue, particularly in the Array.pop method, which can lead to serious security implications.
Vulnerability Detail
A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in the Array.pop method. This flaw can lead to an exploitable crash, allowing attackers to potentially execute arbitrary code. The vulnerability affects specific versions of Firefox ESR, Firefox, and Thunderbird, making it critical for users of these applications to address the issue promptly.
How To Fix
Minimum fixed version
60.7.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade mozjs60Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the affected versions of Firefox and Thunderbird until they are updated. It is advisable to switch to alternative browsers or email clients that do not rely on the vulnerable version of the mozjs60 package.
Conclusion
The identified type confusion vulnerability in the mozjs60 package poses significant risks to applications relying on it, particularly Firefox and Thunderbird. Users are strongly encouraged to update to the patched version to mitigate potential exploits. Utilizing tools like Vulert can enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for mozjs60 →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
The vulnerability affects Firefox ESR versions below 60.7.1, Firefox versions below 67.0.3, and Thunderbird versions below 60.7.2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider using alternative software that does not rely on the vulnerable version of the mozjs60 package.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for mozjs60.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
