CVE-2019-11695: Medium severity Mozilla Firefox vulnerability
A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 67 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 137.0.2-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11695?
CVE-2019-11695 is a vulnerability that allows a custom cursor defined by scripting on a site to position itself over the address bar, spoofing the actual cursor and potentially tricking users into clicking on permission prompts or notification windows.
Which software products are affected by CVE-2019-11695?
Mozilla Firefox versions up to 67.0, Debian Firefox version 118.0.2-1, and various Ubuntu Firefox versions up to 67.0+ are affected by this vulnerability.
What is the severity of CVE-2019-11695?
The severity of CVE-2019-11695 is classified as medium with a severity value of 4.
How can I fix CVE-2019-11695?
To fix CVE-2019-11695, update your Mozilla Firefox to version 67.0 or higher, Debian Firefox to version 118.0.2-1, or Ubuntu Firefox to version 67.0+.
Where can I find more information about CVE-2019-11695?
You can find more information about CVE-2019-11695 on the Mozilla Bugzilla and Mozilla Security Advisories websites.