{"history":[{"alert":0,"cve":"CVE-2019-11707","id":21767,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.37951, \"percentile\": 0.98571}"},{"alert":0,"cve":"CVE-2019-11707","id":19384,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.37951, \"percentile\": 0.98561}"},{"alert":0,"cve":"CVE-2019-11707","id":17350,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.37951, \"percentile\": 0.98559}"},{"alert":0,"cve":"CVE-2019-11707","id":15413,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.37951, \"percentile\": 0.98559}"},{"alert":0,"cve":"CVE-2019-11707","id":13391,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.37951, \"percentile\": 0.98559}"},{"alert":0,"cve":"CVE-2019-11707","id":11173,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.37951, \"percentile\": 0.98557}"},{"alert":1,"cve":"CVE-2019-11707","id":10704,"kind":"cna","observed_at":1793960400,"payload":"{\"containers\": {\"adp\": [{\"providerMetadata\": {\"dateUpdated\": \"2024-08-04T23:03:32.447Z\", \"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.mozilla.org/security/advisories/mfsa2019-20/\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://www.mozilla.org/security/advisories/mfsa2019-18/\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386\"}, {\"name\": \"GLSA-201908-12\", \"tags\": [\"vendor-advisory\", \"x_refsource_GENTOO\", \"x_transferred\"], \"url\": \"https://security.gentoo.org/glsa/201908-12\"}], \"title\": \"CVE Program Container\"}, {\"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}}, {\"other\": {\"content\": {\"id\": \"CVE-2019-11707\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-02-07T12:49:50.350133Z\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2022-05-23\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707\"}, \"type\": \"kev\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-843\", \"description\": \"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-10-21T23:45:33.091Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2022-05-23T00:00:00.000Z\", \"value\": \"CVE-2019-11707 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"product\": \"Firefox ESR\", \"vendor\": \"Mozilla\", \"versions\": [{\"lessThan\": \"60.7.1\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"product\": \"Firefox\", \"vendor\": \"Mozilla\", \"versions\": [{\"lessThan\": \"67.0.3\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}, {\"product\": \"Thunderbird\", \"vendor\": \"Mozilla\", \"versions\": [{\"lessThan\": \"60.7.2\", \"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.\"}], \"problemTypes\": [{\"descriptions\": [{\"description\": \"Type confusion in Array.pop\", \"lang\": \"en\", \"type\": \"text\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2019-08-15T17:06:17.000Z\", \"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.mozilla.org/security/advisories/mfsa2019-20/\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://www.mozilla.org/security/advisories/mfsa2019-18/\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386\"}, {\"name\": \"GLSA-201908-12\", \"tags\": [\"vendor-advisory\", \"x_refsource_GENTOO\"], \"url\": \"https://security.gentoo.org/glsa/201908-12\"}], \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security@mozilla.org\", \"ID\": \"CVE-2019-11707\", \"STATE\": \"PUBLIC\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"Firefox ESR\", \"version\": {\"version_data\": [{\"version_affected\": \"<\", \"version_value\": \"60.7.1\"}]}}, {\"product_name\": \"Firefox\", \"version\": {\"version_data\": [{\"version_affected\": \"<\", \"version_value\": \"67.0.3\"}]}}, {\"product_name\": \"Thunderbird\", \"version\": {\"version_data\": [{\"version_affected\": \"<\", \"version_value\": \"60.7.2\"}]}}]}, \"vendor_name\": \"Mozilla\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Type confusion in Array.pop\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://www.mozilla.org/security/advisories/mfsa2019-20/\", \"refsource\": \"MISC\", \"url\": \"https://www.mozilla.org/security/advisories/mfsa2019-20/\"}, {\"name\": \"https://www.mozilla.org/security/advisories/mfsa2019-18/\", \"refsource\": \"MISC\", \"url\": \"https://www.mozilla.org/security/advisories/mfsa2019-18/\"}, {\"name\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386\", \"refsource\": \"MISC\", \"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386\"}, {\"name\": \"GLSA-201908-12\", \"refsource\": \"GENTOO\", \"url\": \"https://security.gentoo.org/glsa/201908-12\"}]}}}}, \"cveMetadata\": {\"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"assignerShortName\": \"mozilla\", \"cveId\": \"CVE-2019-11707\", \"datePublished\": \"2019-07-23T13:20:17.000Z\", \"dateReserved\": \"2019-05-03T00:00:00.000Z\", \"dateUpdated\": \"2025-10-21T23:45:33.091Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.1\"}"},{"alert":0,"cve":"CVE-2019-11707","id":8919,"kind":"epss","observed_at":1793895600,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.37951, \"percentile\": 0.98555}"},{"alert":0,"cve":"CVE-2019-11707","id":6707,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.37951, \"percentile\": 0.98554}"},{"alert":0,"cve":"CVE-2019-11707","id":4484,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.37951, \"percentile\": 0.98551}"},{"alert":0,"cve":"CVE-2019-11707","id":2266,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.37951, \"percentile\": 0.98549}"},{"alert":1,"cve":"CVE-2019-11707","id":1097,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2019-11707\", \"cwes\": [\"CWE-843\"], \"dateAdded\": \"2022-05-23\", \"dueDate\": \"2022-06-13\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Unknown\", \"notes\": \"https://nvd.nist.gov/vuln/detail/CVE-2019-11707\", \"product\": \"Firefox and Thunderbird\", \"requiredAction\": \"Apply updates per vendor instructions.\", \"shortDescription\": \"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.\", \"vendorProject\": \"Mozilla\", \"vulnerabilityName\": \"Mozilla Firefox and Thunderbird Type Confusion Vulnerability\"}"}],"record":{"affected":[{"product":"Firefox ESR","vendor":"Mozilla","versions":[{"lessThan":"60.7.1","status":"affected","version":"unspecified","versionType":"custom"}]},{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThan":"67.0.3","status":"affected","version":"unspecified","versionType":"custom"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThan":"60.7.2","status":"affected","version":"unspecified","versionType":"custom"}]}],"cna":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-04T23:03:32.447Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386"},{"name":"GLSA-201908-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201908-12"}],"title":"CVE Program Container"},{"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2019-11707","options":[{"Exploitation":"active"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-02-07T12:49:50.350133Z","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2022-05-23","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707"},"type":"kev"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-843","description":"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-10-21T23:45:33.091Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707"}],"timeline":[{"lang":"en","time":"2022-05-23T00:00:00.000Z","value":"CVE-2019-11707 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Firefox ESR","vendor":"Mozilla","versions":[{"lessThan":"60.7.1","status":"affected","version":"unspecified","versionType":"custom"}]},{"product":"Firefox","vendor":"Mozilla","versions":[{"lessThan":"67.0.3","status":"affected","version":"unspecified","versionType":"custom"}]},{"product":"Thunderbird","vendor":"Mozilla","versions":[{"lessThan":"60.7.2","status":"affected","version":"unspecified","versionType":"custom"}]}],"descriptions":[{"lang":"en","value":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2."}],"problemTypes":[{"descriptions":[{"description":"Type confusion in Array.pop","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2019-08-15T17:06:17.000Z","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","shortName":"mozilla"},"references":[{"tags":["x_refsource_MISC"],"url":"https://www.mozilla.org/security/advisories/mfsa2019-20/"},{"tags":["x_refsource_MISC"],"url":"https://www.mozilla.org/security/advisories/mfsa2019-18/"},{"tags":["x_refsource_MISC"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386"},{"name":"GLSA-201908-12","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201908-12"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@mozilla.org","ID":"CVE-2019-11707","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Firefox ESR","version":{"version_data":[{"version_affected":"<","version_value":"60.7.1"}]}},{"product_name":"Firefox","version":{"version_data":[{"version_affected":"<","version_value":"67.0.3"}]}},{"product_name":"Thunderbird","version":{"version_data":[{"version_affected":"<","version_value":"60.7.2"}]}}]},"vendor_name":"Mozilla"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Type confusion in Array.pop"}]}]},"references":{"reference_data":[{"name":"https://www.mozilla.org/security/advisories/mfsa2019-20/","refsource":"MISC","url":"https://www.mozilla.org/security/advisories/mfsa2019-20/"},{"name":"https://www.mozilla.org/security/advisories/mfsa2019-18/","refsource":"MISC","url":"https://www.mozilla.org/security/advisories/mfsa2019-18/"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","refsource":"MISC","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1544386"},{"name":"GLSA-201908-12","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201908-12"}]}}}},"cveMetadata":{"assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","assignerShortName":"mozilla","cveId":"CVE-2019-11707","datePublished":"2019-07-23T13:20:17.000Z","dateReserved":"2019-05-03T00:00:00.000Z","dateUpdated":"2025-10-21T23:45:33.091Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"cna_checked":1793960400,"cve":"CVE-2019-11707","description":"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.","epss":{"date":"2026-11-12","epss":0.37951,"percentile":0.98571},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2019-11707","cwes":["CWE-843"],"dateAdded":"2022-05-23","dueDate":"2022-06-13","forensicTriage":"No","knownRansomwareCampaignUse":"Unknown","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11707","product":"Firefox and Thunderbird","requiredAction":"Apply updates per vendor instructions.","shortDescription":"Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash.","vendorProject":"Mozilla","vulnerabilityName":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability"},"kev_checked":1794522003,"products":"Mozilla Firefox ESR, Mozilla Firefox, Mozilla Thunderbird","references":["https://www.mozilla.org/security/advisories/mfsa2019-20/","https://www.mozilla.org/security/advisories/mfsa2019-18/","https://bugzilla.mozilla.org/show_bug.cgi?id=1544386","https://security.gentoo.org/glsa/201908-12","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11707"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"CISA-ADP","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"Mozilla Firefox and Thunderbird Type Confusion Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}