CVE-2019-11697: Input Validation
First published: Tue May 21 2019(Updated: )
If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <67 | 67 |
| Mozilla Firefox | <67.0 | |
| debian/firefox | 133.0.3-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1440079
- https://www.mozilla.org/security/advisories/mfsa2019-13/
- https://launchpad.net/bugs/cve/CVE-2019-11697
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11693
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11697
- https://security-tracker.debian.org/tracker/CVE-2019-11697
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11697
- https://nvd.nist.gov/vuln/detail/CVE-2019-11697
- https://ubuntu.com/security/CVE-2019-11697
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2019-11697?
CVE-2019-11697 is a vulnerability in Mozilla Firefox that allows a malicious web page to install extensions without user consent.
What is the severity of CVE-2019-11697?
CVE-2019-11697 has a severity score of 6.5, which is considered medium.
How can I fix CVE-2019-11697?
To fix CVE-2019-11697, update Mozilla Firefox to version 67.0 or higher.
Where can I find more information about CVE-2019-11697?
You can find more information about CVE-2019-11697 on the Mozilla website and the Bugzilla entry.
What is the CWE classification of CVE-2019-11697?
CVE-2019-11697 is classified as CWE-20, which is Improper Input Validation.
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/severity
- agent/weakness
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- source/Mozilla
- agent/software-canonical-lookup
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox
- package-manager/debian