CVE-2019-9804: OS Command Injection
First published: Tue Mar 19 2019(Updated: )
In Firefox Developer Tools it is possible that pasting the result of the 'Copy as cURL' command into a command shell on macOS will cause the execution of unintended additional bash script commands if the URL was maliciously crafted. This is the result of an issue with the native version of Bash on macOS. Note: This issue only affects macOS. Other operating systems are unaffected.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <66 | 66 |
| Mozilla Firefox | <66.0 | |
| Apple Mac OS X | ||
| <66 | 66 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-9804.
What is the severity of CVE-2019-9804?
The severity of CVE-2019-9804 is critical with a severity value of 9.8.
Which software is affected by CVE-2019-9804?
Mozilla Firefox versions up to and excluding 66.0 and Apple Mac OS X are affected by CVE-2019-9804.
How can I fix CVE-2019-9804?
Update Mozilla Firefox to version 66 or later to fix CVE-2019-9804.
What is the Common Weakness Enumeration (CWE) ID for CVE-2019-9804?
The CWE ID for CVE-2019-9804 is CWE-78.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/description
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- agent/tags
- source/Mozilla
- agent/software-canonical-lookup
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- vendor/mozilla
- canonical/mozilla firefox
- vendor/apple
- canonical/apple mac os x