PT-2019-4550 · Mozilla+3 · Firefox+3

Ari Trachtenberg + 1 · Published 2019-07-11 · Updated 2024-12-12 · CVE-2019-11728

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68

Description The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that is accessible to a user when web content is loaded. This issue is related to insufficient input validation, which may allow a remote attacker to access confidential data.

Recommendations For Firefox versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider disabling the use of the Alt-Svc header until a patch is available. Restrict access to sensitive data and networks to minimize the risk of exploitation.

Fix

RCE

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-20

CWE-668

Related Identifiers

ALT-PU-2019-2301

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2020-00596

CVE-2019-11728

MGASA-2019-0213

MGASA-2019-0272

OPENSUSE-SU-2019:2248-1

OPENSUSE-SU-2019:2249-1

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2248-1

OPENSUSE-SU-2019_2249-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:14246-1

SUSE-SU-2019:2515-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4054-1

USN-4054-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2138

• https://osv.dev/vulnerability/USN-4054-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11721 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11717 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11728 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11728 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11727 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-21 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0esr/releasenotes · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11711 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0/releasenotes · Vendor Advisory