CVE-2019-11717: Medium severity Mozilla Thunderbird vulnerability
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 68 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 60.8 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 68 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 60.8 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 60.8.0-r0 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 68.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2019-11717?
CVE-2019-11717 is a vulnerability where the caret ( ^ ) character is improperly escaped constructing some URIs, allowing for possible spoofing of origin attributes.
Which software versions are affected by CVE-2019-11717?
CVE-2019-11717 affects Firefox ESR versions earlier than 60.8, Firefox versions earlier than 68, and Thunderbird versions earlier than 60.8.
What is the severity of CVE-2019-11717?
The severity of CVE-2019-11717 is medium with a CVSS score of 5.3.
How can I fix CVE-2019-11717?
To fix CVE-2019-11717, users should update to Firefox ESR version 60.8 or later, Firefox version 68 or later, or Thunderbird version 60.8 or later.
Where can I find more information about CVE-2019-11717?
More information about CVE-2019-11717 can be found at the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1548306), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2019-23/), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2019-28/).