CVE-2019-9796

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 60.6 Firefox ESR versions prior to 60.6 Firefox versions prior to 66

Description A use-after-free issue occurs due to the SMIL animation controller incorrectly registering with the refresh driver twice. This leaves a dangling pointer to the driver's observer array when the animation controller element is removed, potentially allowing a remote attacker to gain unauthorized access to information and compromise its integrity.

Recommendations For Thunderbird versions prior to 60.6, update to version 60.6 or later. For Firefox ESR versions prior to 60.6, update to version 60.6 or later. For Firefox versions prior to 66, update to version 66 or later.