PT-2019-4562 · Mozilla+2 · Firefox+2

Abdulrahman Alqabandi · Published 2019-05-21 · Updated 2024-12-12 · CVE-2019-11696

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 67

Description The issue concerns the handling of executable content for applications with the .JNLP extension, which are used for "Java web start" applications. These files are not treated as executable content for download prompts, even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. Exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For versions prior to 67, update to version 67 or later to resolve the issue. As a temporary workaround, consider disabling the execution of .JNLP files until a patch is applied. Restrict access to Java web start applications to minimize the risk of exploitation. Avoid launching executable binaries locally from download prompts to prevent potential attacks.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-1941

ALT-PU-2019-2324

ALT-PU-2019-2479

ALT-PU-2019-2486

BDU:2020-00608

CVE-2019-11696

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3991-1

USN-3991-2

USN-3991-3

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1899

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1392955 · Exploit
• https://mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11696 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9820 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11696 · Security Note
• https://ubuntu.com/security/CVE-2019-11692 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00608 · Security Note
• https://osv.dev/vulnerability/USN-3991-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11696 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11691 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11697 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11699 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3991-1 · Vendor Advisory