PT-2019-5019 · Mozilla+2 · Firefox+2

Kevin Brosnan · Published 2019-10-22 · Updated 2024-12-12 · CVE-2019-17002

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 70

Description The issue is related to a security policy vulnerability in the Firefox web browser, which is connected to an insufficient input validation mechanism. This could allow a remote attacker to impact data integrity due to the use of the HTTP protocol. Additionally, if the upgrade-insecure-requests directive was specified in the Content Security Policy and a link was dragged and dropped from that page, the link was not upgraded to HTTPS.

Recommendations For Firefox versions prior to 70, update to version 70 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the HTTP protocol for sensitive data until the update is applied. Restrict access to unsecured links to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2019-3087

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

BDU:2020-01650

CVE-2019-17002

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-4165-1

USN-4165-2

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1894

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1561056 · Exploit
• https://ubuntu.com/security/CVE-2019-11765 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11761 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17002 · Security Note
• https://osv.dev/vulnerability/USN-4165-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11760 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4165-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-17002 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-17002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17000 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11764 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01650 · Security Note