CVE-2019-11763: XSS
First published: Tue Oct 22 2019(Updated: )
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/firefox | <0:68.2.0-4.el6_10 | 0:68.2.0-4.el6_10 |
| redhat/thunderbird | <0:68.2.0-2.el6_10 | 0:68.2.0-2.el6_10 |
| redhat/firefox | <0:68.2.0-1.el7_7 | 0:68.2.0-1.el7_7 |
| redhat/thunderbird | <0:68.2.0-1.el7_7 | 0:68.2.0-1.el7_7 |
| redhat/firefox | <0:68.2.0-2.el8_0 | 0:68.2.0-2.el8_0 |
| redhat/thunderbird | <0:68.2.0-1.el8_0 | 0:68.2.0-1.el8_0 |
| redhat/firefox | <68.2 | 68.2 |
| redhat/thunderbird | <68.2 | 68.2 |
| Mozilla Firefox ESR | <68.2 | 68.2 |
| Mozilla Thunderbird | <68.2 | 68.2 |
| Mozilla Firefox | <70 | 70 |
| Mozilla Firefox | <70.0 | |
| Mozilla Firefox ESR | <68.2 | |
| Mozilla Thunderbird | <68.2 | |
| Canonical Ubuntu Linux | =16.04 | |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/firefox | <70.0 | 70.0 |
| ubuntu/firefox | <70.0+ | 70.0+ |
| ubuntu/thunderbird | <1:68.2.1+ | 1:68.2.1+ |
| ubuntu/thunderbird | <1:68.2.1+ | 1:68.2.1+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <1:68.2.0+ | 1:68.2.0+ |
| ubuntu/thunderbird | <68.2 | 68.2 |
| ubuntu/thunderbird | <1:68.7.0+ | 1:68.7.0+ |
| debian/firefox | 125.0.3-1 | |
| debian/firefox-esr | 91.12.0esr-1~deb10u1 115.10.0esr-1~deb10u1 115.7.0esr-1~deb11u1 115.10.0esr-1~deb11u1 115.7.0esr-1~deb12u1 115.10.0esr-1~deb12u1 115.10.0esr-1 | |
| debian/thunderbird | 1:91.12.0-1~deb10u1 1:115.10.1-1~deb10u1 1:115.7.0-1~deb11u1 1:115.10.1-1~deb11u1 1:115.7.0-1~deb12u1 1:115.10.1-1~deb12u1 1:115.10.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2019-11763 https://nvd.nist.gov/vuln/detail/CVE-2019-11763 https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11763
- https://bugzilla.redhat.com/show_bug.cgi?id=1764444
- https://access.redhat.com/errata/RHSA-2019:3281
- https://access.redhat.com/errata/RHSA-2019:3756
- https://access.redhat.com/errata/RHSA-2019:3193
- https://access.redhat.com/errata/RHSA-2019:3210
- https://access.redhat.com/errata/RHSA-2019:3196
- https://access.redhat.com/errata/RHSA-2019:3237
- https://access.redhat.com/security/cve/cve-2019-11763
- https://bugzilla.mozilla.org/show_bug.cgi?id=1584216
- https://www.mozilla.org/security/advisories/mfsa2019-33/
- https://www.mozilla.org/security/advisories/mfsa2019-34/
- https://www.mozilla.org/security/advisories/mfsa2019-35/
- https://security.gentoo.org/glsa/202003-10
- https://usn.ubuntu.com/4335-1/
- https://launchpad.net/bugs/cve/CVE-2019-11763
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11763
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-33/#CVE-2019-11764
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-34/#CVE-2019-11763
- https://www.mozilla.org/en-US/security/advisories/mfsa2019-35/#CVE-2019-11763
- https://security-tracker.debian.org/tracker/CVE-2019-11763
- https://ubuntu.com/security/notices/USN-4165-1
- https://ubuntu.com/security/notices/USN-4202-1
- https://ubuntu.com/security/notices/USN-4335-1
- https://www.cve.org/CVERecord?id=CVE-2019-11763
- https://nvd.nist.gov/vuln/detail/CVE-2019-11763
- https://ubuntu.com/security/CVE-2019-11763
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2019-11763?
CVE-2019-11763 is a vulnerability found in Mozilla Firefox and Thunderbird that allows for XSS attacks.
How severe is CVE-2019-11763?
CVE-2019-11763 has a severity rating of medium.
Which software is affected by CVE-2019-11763?
Mozilla Firefox and Thunderbird versions up to 68.2.0-4.el6_10, 68.2.0-2.el6_10, 68.2.0-1.el7_7, 68.2.0-1.el8_0, and 68.2.0-2.el8_0 are affected by CVE-2019-11763.
How can I fix CVE-2019-11763?
To fix CVE-2019-11763, update Mozilla Firefox and Thunderbird to version 68.2 or later.
Where can I find more information about CVE-2019-11763?
You can find more information about CVE-2019-11763 on the Mozilla website and Bugzilla.
- collector/redhat-cve
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-11763
- agent/software-canonical-lookup
- collector/mozilla-advisory
- source/Mozilla
- agent/description
- agent/severity
- agent/software-canonical-lookup-request
- agent/weakness
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- agent/event
- agent/references
- agent/tags
- collector/usn-cve
- source/Ubuntu
- agent/softwarecombine
- collector/security-tracker-debian
- source/Debian
- package-manager/redhat
- vendor/mozilla
- canonical/mozilla firefox esr
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- package-manager/ubuntu
- package-manager/debian