PT-2019-12486 · Mozilla+5 · Firefox+5

Published 2019-08-14 · Updated 2024-12-12 · CVE-2019-11733

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68.0.2 Firefox ESR versions prior to 68.0.2

Description A security issue was found where locally stored passwords can be copied to the clipboard through the 'copy password' context menu item without re-entering the master password, if the master password had been previously entered in the same session. This could potentially allow for theft of stored passwords.

Recommendations For Firefox versions prior to 68.0.2, update to version 68.0.2 or later to resolve the issue. For Firefox ESR versions prior to 68.0.2, update to version 68.0.2 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2019-2484

ALT-PU-2019-2486

ALT-PU-2019-2686

ALT-PU-2020-1617

CESA-2019_2663

CESA-2019_2694

CESA-2019_2729

CVE-2019-11733

MGASA-2019-0268

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2019:2663

RHSA-2019:2694

RHSA-2019:2729

RHSA-2019_2663

RHSA-2019_2694

RHSA-2019_2729

SUSE-SU-2019:14246-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4101-1

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 2104

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5172.md · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2019-11708 · Exploit
• 🔥 https://github.com/0vercl0k/CVE-2019-9810 · Exploit
• 🔥 https://github.com/xuechiyaobai/CVE-2019-9810-PoC · Exploit
• 🔥 https://github.com/sophoslabs/CVE-2018-18500 · Exploit
• 🔥 https://github.com/maxpl0it/CVE-2019-17026-Exploit · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• 🔥 https://github.com/lsw29475/CVE-2019-17026 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11733 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0268 · Vendor Advisory