PT-2019-4558 · Mozilla+3 · Firefox+3

Hanno Böck · Published 2019-07-09 · Updated 2024-12-12 · CVE-2019-11714

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68

Description The issue is related to a flaw in the Necko network library of the Firefox browser, specifically concerning incorrect access to a child element during UDP connections due to a threading error. This could potentially allow a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability may result in a crash in some instances.

Recommendations For versions prior to 68, update to version 68 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-2301

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2020-00604

CVE-2019-11714

MGASA-2019-0213

MGASA-2019-0272

OPENSUSE-SU-2019:2248-1

OPENSUSE-SU-2019:2249-1

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2248-1

OPENSUSE-SU-2019_2249-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2019:14246-1

SUSE-SU-2019:2515-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4054-1

USN-4054-2

Affected Products

Alt Linux

Firefox

Suse

Ubuntu

References · 2137

• https://osv.dev/vulnerability/USN-4054-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11721 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1542593 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11717 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11728 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11727 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-21 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0esr/releasenotes · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11711 · Vendor Advisory
• https://mozilla.org/en-US/firefox/68.0/releasenotes · Vendor Advisory