PT-2019-4553 · Mozilla+3 · Firefox+3

Andreas Wagner · Published 2019-07-09 · Updated 2024-12-12 · CVE-2019-11723

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68

Description The issue is related to a lack of protection for service data, which could allow a remote attacker to access confidential information. It is also associated with the installation of add-ons, where the initial fetch ignores the origin attributes of the browsing context, potentially leaking cookies in private browsing mode or across different containers for users of the Firefox Multi-Account Containers Web Extension.

Recommendations For versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider disabling the installation of add-ons until a patch is available. Restrict access to sensitive data and avoid using private browsing mode or the Firefox Multi-Account Containers Web Extension in affected versions.

Fix

Information Disclosure

Origin Validation Error

Weakness Enumeration

CWE-200

CWE-346

Related Identifiers

ALT-PU-2019-2301

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2020-00599

CVE-2019-11723

MGASA-2019-0213

MGASA-2019-0272

OPENSUSE-SU-2019:2248-1

OPENSUSE-SU-2019:2249-1

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2248-1

OPENSUSE-SU-2019_2249-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:14246-1

SUSE-SU-2019:2515-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4054-1

USN-4054-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2136

• https://osv.dev/vulnerability/USN-4054-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11721 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11717 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11728 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1528335 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11727 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-21 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0esr/releasenotes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11723 · Security Note
• https://ubuntu.com/security/CVE-2019-11711 · Vendor Advisory