CVE-2019-11718
First published: Tue Jul 09 2019(Updated: )
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper Service were compromised.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <68 | 68 |
| <68 | 68 | |
| Mozilla Firefox | <68.0 | |
| openSUSE Leap | =15.0 | |
| openSUSE Leap | =15.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1408349
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-21/#CVE-2019-11727
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
- https://security.gentoo.org/glsa/201908-12
- https://www.mozilla.org/security/advisories/mfsa2019-21/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-11718.
What software is affected by this vulnerability?
The affected software includes Mozilla Firefox version up to and excluding 68, and openSUSE Leap versions 15.0 and 15.1.
What is the severity of CVE-2019-11718?
The severity of CVE-2019-11718 is medium with a CVSS score of 5.3.
How can the vulnerability be exploited?
The vulnerability can be exploited by displaying content from the Snippet Service website without sanitization, potentially granting access to other information on the Activity Stream page.
Are there any remediation steps available?
Yes, applying the available updates, specifically version 68 for Mozilla Firefox, can help mitigate the vulnerability.
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/weakness
- agent/author
- agent/references
- agent/severity
- agent/description
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- source/Mozilla
- agent/software-canonical-lookup
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- vendor/mozilla
- canonical/mozilla firefox
- vendor/opensuse
- canonical/opensuse leap
- version/opensuse leap/15.0
- version/opensuse leap/15.1