LiveActive security incident?Get immediate response
CVE Record

CVE-2019-11691: A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing t...

A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a Mozilla memory-safety flaw in Firefox, Firefox ESR, and Thunderbird. A malformed or unexpected XMLHttpRequest event-loop condition could cause a crash after freed memory is reused. The sources call it potentially exploitable, but provide no CVSS score or active-exploitation evidence.

Executive priority

Prioritize remediation where affected Mozilla clients remain in active use, especially on user workstations. The issue is old, but unpatched browser or mail-client memory corruption remains meaningful because users routinely process untrusted web and message content.

Technical view

CVE-2019-11691 is a use-after-free involving XMLHttpRequest in an event loop, where the XHR main thread can be invoked after it has been freed. Affected versions are Thunderbird before 60.7, Firefox before 67, and Firefox ESR before 60.7.

Likely exposure

Exposure is most likely on legacy endpoints still running Firefox < 67, Firefox ESR < 60.7, or Thunderbird < 60.7. Modern managed fleets should have limited exposure if browser and mail-client patching is enforced.

Exploitation context

The provided sources describe a potentially exploitable crash, but do not state active exploitation. CISA KEV status is false in the bundle. Treat this as a memory-corruption risk requiring patch verification, not as confirmed in-the-wild exploitation.

Researcher notes

The bundle provides root-cause and affected-version information but no CVSS vector, CWE, exploit details, or confirmed exploitation. Analysis should stay anchored to Mozilla advisories and Bugzilla reference 1542465, avoiding assumptions about exploitability beyond the stated potentially exploitable crash.

Mitigation direction

  • Upgrade Firefox to version 67 or later.
  • Upgrade Firefox ESR to version 60.7 or later.
  • Upgrade Thunderbird to version 60.7 or later.
  • Review Mozilla advisories for any product-specific deployment guidance.
  • Remove unsupported legacy Mozilla builds from managed endpoints.

Validation and detection

  • Inventory installed Firefox, Firefox ESR, and Thunderbird versions across endpoints.
  • Confirm no affected versions remain below the fixed release thresholds.
  • Review endpoint management records for successful Mozilla update deployment.
  • Check crash telemetry for unusual browser or Thunderbird crashes, where available.
  • Document exceptions for systems that cannot be upgraded immediately.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-11691 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
MozillaThunderbirdunspecifiedListed
MozillaFirefoxunspecifiedListed
MozillaFirefox ESRunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.