PT-2019-12484 · Mozilla+1 · Firefox+1

James Lee · Publicado 2019-06-11 · Atualizado 2020-08-24 · CVE-2019-11702

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 67.0.2

Description A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with Internet Explorer if a user approves execution when prompted. This issue only occurs on Windows, and other operating systems are unaffected.

Recommendations For versions prior to 67.0.2, update to Firefox 67.0.2 to resolve the issue. As a temporary workaround, consider avoiding the use of hyperlinks with the IE.HTTP: protocol until the update is applied. Restrict access to local files to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

ALT-PU-2019-2098

CVE-2019-11702

Produtos afetados

Alt Linux

Firefox

Referências · 6

• https://bugzilla.mozilla.org/show_bug.cgi?id=1552627 · Aviso do Fabricante
• https://mozilla.org/security/advisories/mfsa2019-16 · Aviso do Fabricante
• https://t.me/tmfeed/64690 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-11702 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11702 · Nota de Segurança
• https://t.me/opennews/5233 · Publicação no Telegram