# CVE-2019-9792: firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This... CVE-2019-9792 is fixed in 11 products on 1 platform, first by firefox 66.0+build3-0ubuntu0.18.04.1, released March 19, 2019. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2019-9792 - Priority: Urgent - CVSS: 9.8 (Critical) - EPSS: 0.1330 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 19, 2019 ## Description Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 60.6.1 ESR. (BZ#1690308) Security Fix(es): * Mozilla: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788) * Mozilla: Use-after-free when removing in-use DOM elements (CVE-2019-9790) * Mozilla: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791) * Mozilla: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792) * Mozilla: IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810) * Mozilla: Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813) * Mozilla: Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793) * Mozilla: Type-confusion in IonMonkey JIT compiler (CVE-2019-9795) * Mozilla: Use-after-free with SMIL animation controller (CVE-2019-9796) * Mozilla: Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | firefox RHEL 8 | 0:60.6.1-1.el8 | [RHSA-2019:0966](https://patchblox.com/security/data/fix/linux/rhsa-2019-0966.md) | May 7, 2019 | | Linux | firefox Ubuntu 18.04.6 LTS (bionic) | 66.0+build3-0ubuntu0.18.04.1 | [firefox 66.0+build3-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-66.0-build3-0ubuntu0.18.04.1.md) | Mar 19, 2019 | | Linux | firefox ol 8 | 0:60.6.1-1.0.2.el8 | [ELSA-2019-0966](https://patchblox.com/security/data/fix/linux/elsa-2019-0966.md) | Jul 30, 2019 | | Linux | firefox-globalmenu Ubuntu 18.04.6 LTS (bionic) | 66.0+build3-0ubuntu0.18.04.1 | [firefox-globalmenu 66.0+build3-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-globalmenu-66.0-build3-0ubuntu0.18.04.1.md) | Mar 19, 2019 | | Linux | firefox-mozsymbols Ubuntu 18.04.6 LTS (bionic) | 66.0+build3-0ubuntu0.18.04.1 | [firefox-mozsymbols 66.0+build3-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-mozsymbols-66.0-build3-0ubuntu0.18.04.1.md) | Mar 19, 2019 | | Linux | firefox-testsuite Ubuntu 18.04.6 LTS (bionic) | 66.0+build3-0ubuntu0.18.04.1 | [firefox-testsuite 66.0+build3-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-firefox-testsuite-66.0-build3-0ubuntu0.18.04.1.md) | Mar 19, 2019 | | Linux | thunderbird RHEL 8 | 0:60.6.1-1.el8 | [RHSA-2019:1144](https://patchblox.com/security/data/fix/linux/rhsa-2019-1144.md) | May 13, 2019 | | Linux | thunderbird Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [thunderbird 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-thunderbird-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | | Linux | thunderbird ol 8 | 0:60.6.1-1.0.1.el8 | [ELSA-2019-1144](https://patchblox.com/security/data/fix/linux/elsa-2019-1144.md) | Jul 30, 2019 | | Linux | thunderbird-globalmenu Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [thunderbird-globalmenu 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-thunderbird-globalmenu-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | | Linux | thunderbird-gnome-support Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [thunderbird-gnome-support 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-thunderbird-gnome-support-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | | Linux | thunderbird-mozsymbols Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [thunderbird-mozsymbols 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-thunderbird-mozsymbols-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | | Linux | xul-ext-calendar-timezones Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [xul-ext-calendar-timezones 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xul-ext-calendar-timezones-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | | Linux | xul-ext-gdata-provider Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [xul-ext-gdata-provider 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xul-ext-gdata-provider-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | | Linux | xul-ext-lightning Ubuntu 18.04.6 LTS (bionic) | 1:60.6.1+build2-0ubuntu0.18.04.1 | [xul-ext-lightning 1:60.6.1+build2-0ubuntu0.18.04.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-xul-ext-lightning-1-60.6.1-build2-0ubuntu0.18.04.1.md) | Mar 24, 2019 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo