PT-2019-5152 · Mozilla+5 · Firefox+5

Wladimir Palant · Published 2019-09-03 · Updated 2024-12-12 · CVE-2019-11738

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 69 Firefox ESR versions prior to 68.1

Description The issue is related to Content Security Policy (CSP) directives that use hash-based sources. If such a directive is defined with an empty string as input, it allows the execution of any javascript: URIs, potentially bypassing CSP permissions and enabling malicious JavaScript content to run. This could allow a remote attacker to execute arbitrary code.

Recommendations For Firefox versions prior to 69, update to version 69 or later to resolve the issue. For Firefox ESR versions prior to 68.1, update to version 68.1 or later to resolve the issue.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALT-PU-2019-2640

ALT-PU-2019-2644

ALT-PU-2019-2686

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

BDU:2020-01822

CESA-2019_2663

CVE-2019-11738

MGASA-2019-0268

OPENSUSE-SU-2019:2251-1

OPENSUSE-SU-2019:2260-1

OPENSUSE-SU-2019_2251-1

OPENSUSE-SU-2019_2260-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2019:2663

RHSA-2019_2663

SUSE-SU-2019:14246-1

SUSE-SU-2019:2545-1

SUSE-SU-2019:2620-1

SUSE-SU-2019_14246-1

USN-4122-1

USN-4122-2

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Suse

Ubuntu

References · 2123

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1452037 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11738 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11738 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0268 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11742 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2019-25 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-25 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11744 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2019-24 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2260-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-11752 · Vendor Advisory