PT-2019-4559 · Mozilla+2 · Firefox+2

Peter Af Geijerstam · Published 2019-05-21 · Updated 2024-12-12 · CVE-2019-11701

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 67

Description The default webcal: protocol handler in Firefox is vulnerable to cross-site scripting (XSS) attacks, which could allow a remote attacker to impact data integrity. This issue only affects users with an account on the vulnerable service, while other users are unaffected.

Recommendations For versions prior to 67, update to version 67 or later to resolve the issue. As a temporary workaround, consider disabling the webcal: protocol handler until a patch is available. Restrict access to the vulnerable service to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2019-1941

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2020-00605

CVE-2019-11701

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3991-1

USN-3991-2

USN-3991-3

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1899

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9820 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11692 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3991-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11696 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11691 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1518627 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11697 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11699 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3991-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00605 · Security Note
• https://ubuntu.com/security/CVE-2019-9817 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11695 · Vendor Advisory