PT-2019-6393 · Mozilla+2 · Firefox+1

Georg Koppen + 1 · Publicado 2019-05-27 · Atualizado 2019-07-08 · CVE-2019-13075

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tor Browser versions prior to 8.5.4

Description The issue allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This behavior is related to a similar issue in Firefox before version 68.

Recommendations For Tor Browser versions prior to 8.5.4, update to version 8.5.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of IFRAME elements until a patch is applied. Avoid using the title attribute of LINK elements for non-HTML pages in the affected browser versions.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2023-07805

CVE-2019-13075

Produtos afetados

Firefox

Tor Browser

Referências · 13

• 🔥 https://hackerone.com/reports/588239 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13075 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-13075 · Aviso do Fabricante
• https://trac.torproject.org/projects/tor/ticket/30657 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-07805 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-13075 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2019-13075 · Aviso do Fabricante
• https://t.me/malwr/1539 · Publicação no Telegram
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13075 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-13075 · Aviso do Fabricante
• https://gitlab.torproject.org/legacy/trac/-/issues/30657 · Nota
• https://cve.org/CVERecord?id=CVE-2019-13075 · Nota de Segurança