PT-2019-19874 · Gnu+2 · Bash+2

Potatoe · Published 2019-04-01 · Updated 2024-12-12 · CVE-2019-9804

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 66

Description The issue arises when the result of the 'Copy as cURL' command in Firefox Developer Tools is pasted into a command shell on macOS, potentially leading to the execution of unintended additional bash script commands if the URL was maliciously crafted. This is due to a problem with the native version of Bash on macOS. The issue is exclusive to macOS, with other operating systems being unaffected.

Recommendations For Firefox versions prior to 66, update to version 66 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the 'Copy as cURL' command in Firefox Developer Tools when working with potentially malicious URLs on macOS.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2019-1561

CVE-2019-9804

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Affected Products

Alt Linux

Bash

Firefox

References · 1871

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9804 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-07/#CVE-2019-9804 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-9804 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-9804 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9804 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-07 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9804 · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-25728 · Note
• https://suse.com/security/cve/CVE-2022-31743 · Note
• https://suse.com/security/cve/CVE-2018-12392 · Note
• https://suse.com/security/cve/CVE-2024-5698 · Note
• https://suse.com/security/cve/CVE-2013-1701 · Note
• https://suse.com/security/cve/CVE-2024-5687 · Note