PT-2018-3985 · Mozilla+3 · Firefox+3

Andrey · Published 2018-08-15 · Updated 2024-12-12 · CVE-2019-11725

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68

Description The issue is related to shortcomings in the authorization procedure of the Firefox web browser. It may allow a remote attacker to compromise data integrity. When a user visits a site marked as unsafe by the Safebrowsing API, warning messages are displayed, but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections.

Recommendations For Firefox versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting the use of websockets for sites marked as unsafe by the Safebrowsing API until a patch is available. Avoid using websockets to load resources from potentially unsafe sites until the issue is resolved.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

ALT-PU-2019-2301

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2024-07610

CVE-2019-11725

MGASA-2019-0213

MGASA-2019-0272

OPENSUSE-SU-2019:2248-1

OPENSUSE-SU-2019:2249-1

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2248-1

OPENSUSE-SU-2019_2249-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:14246-1

SUSE-SU-2019:2515-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4054-1

USN-4054-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2135

• https://osv.dev/vulnerability/USN-4054-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11721 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11717 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11728 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11725 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11727 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-21 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0esr/releasenotes · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07610 · Security Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1483510 · Vendor Advisory