Vulnerability CVE-2019-11697: Information

Description

If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.

Severity: MEDIUM (6.5) Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-11697
Published: July 23, 2019
Modified: July 29, 2019
Error type identifier: CWE-20

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
firefoxsisyphus67.0-alt1127.0-alt1ALT-PU-2019-1941-1231216Fixed
firefoxp1067.0-alt1118.0.2-alt0.p10.1ALT-PU-2019-1941-1231216Fixed
firefoxp968.0.1-alt0.p9.1105.0.1-alt0.c9.1ALT-PU-2019-2479-1235125Fixed
firefoxp868.0.1-alt0.M80P.168.0.1-alt0.M80P.1ALT-PU-2019-2938-1236175Fixed
firefoxc10f167.0-alt1112.0.2-alt0.p10.1ALT-PU-2019-1941-1231216Fixed
firefoxc9f268.0.1-alt0.p9.1105.0.1-alt0.c9.1ALT-PU-2019-2479-1235125Fixed
firefoxp1167.0-alt1126.0.1-alt1ALT-PU-2019-1941-1231216Fixed
firefox-esrsisyphus68.0.1-alt1115.11.0-alt1ALT-PU-2019-2324-1234871Fixed
firefox-esrp1068.0.1-alt1115.11.0-alt1ALT-PU-2019-2324-1234871Fixed
firefox-esrp968.0.2-alt1102.11.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp868.1.0-alt1.M80P.168.4.1-alt0.M80P.1ALT-PU-2019-2937-1236175Fixed
firefox-esrc10f168.0.1-alt1115.9.1-alt0.c10.1ALT-PU-2019-2324-1234871Fixed
firefox-esrc9f268.0.2-alt1102.12.0-alt0.c9.1ALT-PU-2019-2486-1235108Fixed
firefox-esrp1168.0.1-alt1115.11.0-alt1ALT-PU-2019-2324-1234871Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://www.mozilla.org/security/advisories/mfsa2019-13/
  • Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1440079
  • Issue Tracking
  • Permissions Required
  • Vendor Advisory

    1. Configuration 1

      cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
      End excliding
      67.0
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.3
Back to top