PT-2019-6393 · Mozilla+2 · Firefox+1

Georg Koppen + 1 · Published 2019-05-27 · Updated 2019-07-08 · CVE-2019-13075

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tor Browser versions prior to 8.5.4

Description The issue allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This behavior is related to a similar issue in Firefox before version 68.

Recommendations For Tor Browser versions prior to 8.5.4, update to version 8.5.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of IFRAME elements until a patch is applied. Avoid using the title attribute of LINK elements for non-HTML pages in the affected browser versions.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-07805

CVE-2019-13075

Affected Products

Firefox

Tor Browser

References · 13

• 🔥 https://hackerone.com/reports/588239 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13075 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13075 · Vendor Advisory
• https://trac.torproject.org/projects/tor/ticket/30657 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07805 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-13075 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-13075 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13075 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13075 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13075 · Security Note
• https://t.me/malwr/1539 · Telegram Post
• https://gitlab.torproject.org/legacy/trac/-/issues/30657 · Note