高危
Mozilla Firefox IonMonkey JIT编译器类型混淆漏洞
2020-01-09 00:00:00 公开 ，2026-02-20 21:45:50 更新
- 关键漏洞
- CISA KEV
- APT漏洞
- 远程
- 公开PoC
- 无需认证
- 开源组件漏洞
- CWEs：
- CWE-843 （Type Confusion）
- SSVC：
- 可利用状态：已被积极利用攻击自动化：否技术影响评估：全部 2025-02-07 20:48:51
风险信息
- CVSS v2 向量
- AV:N/AC:M/Au:N/C:P/I:P/A:P
- CVSS v2 风险值
- 6.8
- CVSS v3 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3 风险值
- 8.8
- CVSS v3.1 向量
- AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3.1 风险值
- 8.8
详细信息
- 漏洞类型
- 其他
- 漏洞描述
- Mozilla Firefox等都是美国Mozilla基金会的产品。Mozilla Firefox是一款开源Web浏览器。Mozilla Firefox ESR是Firefox(Web浏览器)的一个延长支持版本。Mozilla Thunderbird是一套从Mozilla Application Suite独立出来的电子邮件客户端软件。Mozilla Firefox可能允许远程攻击者在系统上执行任意代码，由于IonMonkey JIT编译器中设置数组元素的别名信息不正确而导致类型混淆。通过说服受害者访问精心编制的网站，远程攻击者可以使用未知攻击向量利用此漏洞在易受攻击的系统上执行任意代码或造成拒绝服务。
- 修复建议
- 目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/
参考链接
- https://bugzilla.mozilla.org/show_bug.cgi?id=1607443
CVE · x_refsource_MISC
- https://security.gentoo.org/glsa/202003-02
CVE · vendor-advisory · x_refsource_GENTOO
- https://www.mozilla.org/security/advisories/mfsa2020-03/
CVE · x_refsource_MISC
- https://www.mozilla.org/security/advisories/mfsa2020-04/
CVE · x_refsource_MISC
- https://usn.ubuntu.com/4241-1/
- https://www.us-cert.gov/ncas/current-activity/2020/01/08/mozilla-patches-critical-vulnerability
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/
- https://access.redhat.com/errata/RHSA-2020:0111
- https://www.debian.org/lts/security/2020/dla-2093
- https://www.debian.org/security/2020/dsa-4603
- https://access.redhat.com/errata/RHSA-2020:0086
- https://access.redhat.com/errata/RHSA-2020:0085
- https://www.suse.com/support/update/announcement/2020/suse-su-202014268-1.html
- https://www.suse.com/support/update/announcement/2020/suse-su-20200142-1.html
- https://vigilance.fr/vulnerability/Mozilla-Firefox-memory-corruption-via-IonMonkey-JIT-Compiler-31273
- https://www.auscert.org.au/bulletins/ESB-2020.0206/
- https://www.auscert.org.au/bulletins/ESB-2020.0128/
- https://packetstormsecurity.com/files/156704/Gentoo-Linux-Security-Advisory-202003-02.html
- https://packetstormsecurity.com/files/155970/Red-Hat-Security-Advisory-2020-0127-01.html
- https://packetstormsecurity.com/files/156000/Debian-Security-Advisory-4603-1.html
- https://www.auscert.org.au/bulletins/ESB-2020.0078/
- https://www.auscert.org.au/bulletins/ESB-2020.0386/
- https://www.auscert.org.au/bulletins/ESB-2020.0210/
- https://packetstormsecurity.com/files/156158/Red-Hat-Security-Advisory-2020-0295-01.html
- https://packetstormsecurity.com/files/155892/Debian-Security-Advisory-4600-1.html
- https://www.auscert.org.au/bulletins/ESB-2020.0152/
- https://www.auscert.org.au/bulletins/ESB-2020.0118/
- https://www.auscert.org.au/bulletins/ESB-2020.0195/
- https://www.auscert.org.au/bulletins/ESB-2020.0194/
- https://packetstormsecurity.com/files/155932/Red-Hat-Security-Advisory-2020-0085-01.html
- https://packetstormsecurity.com/files/155955/Red-Hat-Security-Advisory-2020-0111-01.html
- https://nvd.nist.gov/vuln/detail/CVE-2019-17026
- https://packetstormsecurity.com/files/155989/Ubuntu-Security-Notice-USN-4241-1.html
- http://packetstormsecurity.com/files/162568/Firefox-72-IonMonkey-JIT-Type-Confusion.html
CVE · x_refsource_MISC
- https://usn.ubuntu.com/4335-1/
CVE · vendor-advisory · x_refsource_UBUNTU
- https://osv.dev/vulnerability/DLA-2093-1
OSV
- https://osv.dev/vulnerability/DLA-2071-1
OSV
- https://osv.dev/vulnerability/DSA-4603-1
OSV
- https://osv.dev/vulnerability/DSA-4600-1
OSV
- https://ubuntu.com/security/CVE-2019-17026
OSV
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-17026
OSV
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/#CVE-2019-17026
OSV
- https://ubuntu.com/security/notices/USN-4234-1
OSV
- https://ubuntu.com/security/notices/USN-4241-1
OSV
- https://ubuntu.com/security/notices/USN-4335-1
OSV
- https://www.cve.org/CVERecord?id=CVE-2019-17026
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
OSV
- https://osv.dev/vulnerability/UBUNTU-CVE-2019-17026
OSV
- https://security-tracker.debian.org/tracker/CVE-2019-17026
OSV
- https://osv.dev/vulnerability/CVE-2019-17026
OSV
- https://osv.dev/vulnerability/DEBIAN-CVE-2019-17026
OSV
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-17026
NVD · US Government Resource