Actively exploited · Published Jul 23, 2019 · Assigned by mozilla
CVE-2019-11708
Critical 10.0 Exploited
In plain English
A critical-severity improper input validation in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2022). The chance it is exploited in the next 30 days is estimated at 55.9% (higher than 99.0% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 13, 2022.
Official description
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox-esr | 60.7.2-r0 | ALPINE-CVE-2019-11708 |
| Alpine:v3.21 | firefox-esr | 60.7.2-r0 | ALPINE-CVE-2019-11708 |
| Alpine:v3.22 | firefox-esr | 60.7.2-r0 | ALPINE-CVE-2019-11708 |
| Alpine:v3.23 | firefox-esr | 60.7.2-r0 | ALPINE-CVE-2019-11708 |
| Debian:12 | firefox-esr | 60.7.2esr-1 | DEBIAN-CVE-2019-11708 |
| Debian:13 | firefox-esr | 60.7.2esr-1 | DEBIAN-CVE-2019-11708 |
| Debian:14 | firefox-esr | 60.7.2esr-1 | DEBIAN-CVE-2019-11708 |
| Debian:12 | thunderbird | 1:60.7.2-1 | DEBIAN-CVE-2019-11708 |
| Debian:13 | thunderbird | 1:60.7.2-1 | DEBIAN-CVE-2019-11708 |
| Debian:14 | thunderbird | 1:60.7.2-1 | DEBIAN-CVE-2019-11708 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox ESR | unspecified – before 60.7.2 |
| Mozilla | Firefox | unspecified – before 67.0.4 |
| Mozilla | Thunderbird | unspecified – before 60.7.2 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://www.mozilla.org/security/advisories/mfsa2019-19/ x_refsource_MISC
- https://www.mozilla.org/security/advisories/mfsa2019-20/ x_refsource_MISC
- https://bugzilla.mozilla.org/show_bug.cgi?id=1559858 x_refsource_MISC
- GLSA-201908-12 vendor-advisory, x_refsource_GENTOO
- http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11708 government-resource