PT-2019-4556 · Mozilla+3 · Firefox+3

Mark Banner · Published 2019-07-09 · Updated 2024-12-12 · CVE-2019-11718

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68

Description The issue is related to the implementation of the Activity Stream page in Firefox, where content is written without proper sanitization, potentially allowing a remote attacker to access confidential data. Specifically, the Activity Stream can display content from the Snippet Service website, which, if compromised, could lead to unauthorized access to other information available to the Activity Stream, such as browsing history.

Recommendations For Firefox versions prior to 68, update to version 68 or later to resolve the issue. As a temporary workaround, consider restricting access to the Snippet Service or disabling the Activity Stream feature until a patch is applied. Avoid using the Activity Stream page with potentially compromised Snippet Service content to minimize the risk of exploitation.

Fix

Special Elements Injection

Information Disclosure

Weakness Enumeration

CWE-74

CWE-200

Related Identifiers

ALT-PU-2019-2301

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2020-00602

CVE-2019-11718

MGASA-2019-0213

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:14246-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4054-1

USN-4054-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2117

• https://osv.dev/vulnerability/USN-4054-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11721 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11717 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11728 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11727 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-21 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0esr/releasenotes · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11711 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0/releasenotes · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11713 · Vendor Advisory