PT-2019-19874 · Gnu+2 · Bash+2

Potatoe · Publicado 2019-04-01 · Atualizado 2024-12-12 · CVE-2019-9804

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 66

Description The issue arises when the result of the 'Copy as cURL' command in Firefox Developer Tools is pasted into a command shell on macOS, potentially leading to the execution of unintended additional bash script commands if the URL was maliciously crafted. This is due to a problem with the native version of Bash on macOS. The issue is exclusive to macOS, with other operating systems being unaffected.

Recommendations For Firefox versions prior to 66, update to version 66 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the 'Copy as cURL' command in Firefox Developer Tools when working with potentially malicious URLs on macOS.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

ALT-PU-2019-1561

CVE-2019-9804

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Produtos afetados

Alt Linux

Bash

Firefox

Referências · 1871

• https://suse.com/security/cve/CVE-2023-25728 · Nota
• https://suse.com/security/cve/CVE-2022-31743 · Nota
• https://suse.com/security/cve/CVE-2018-12392 · Nota
• https://suse.com/security/cve/CVE-2024-5698 · Nota
• https://suse.com/security/cve/CVE-2013-1701 · Nota
• https://suse.com/security/cve/CVE-2024-5687 · Nota
• https://suse.com/security/cve/CVE-2022-24713 · Nota
• https://suse.com/security/cve/CVE-2014-8642 · Nota
• https://suse.com/security/cve/CVE-2015-4516 · Nota
• https://suse.com/security/cve/CVE-2019-11716 · Nota
• https://suse.com/security/cve/CVE-2023-28176 · Nota
• https://suse.com/security/cve/CVE-2021-38494 · Nota
• https://suse.com/security/cve/CVE-2012-1965 · Nota
• https://suse.com/security/cve/CVE-2013-1687 · Nota
• https://suse.com/security/cve/CVE-2020-6822 · Nota