CVE-2019-11708 : Insufficient vetting of parameters passed with the Prompt:Open IPC message betwe

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.

Published 2019-07-23 14:15:15

Updated 2024-07-02 17:02:20

Source Mozilla Corporation

View at NVD, CVE.org

Products affected by CVE-2019-11708

Mozilla » Firefox
Versions before (<) 67.0.4
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
Mozilla » Thunderbird
Versions before (<) 60.7.2
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Matching versions
Mozilla » Firefox Esr
Versions before (<) 60.7.2
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Matching versions

CVE-2019-11708 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Mozilla Firefox and Thunderbird contain a sandbox escape vulnerability that could result in remote code execution.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2019-11708

Added on 2022-05-23 Action due date 2022-06-13

Exploit prediction scoring system (EPSS) score for CVE-2019-11708

EPSS FAQ

2.54%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 90 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-11708

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
10.0	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	NIST	2024-07-02
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-11708

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-11708

https://bugzilla.mozilla.org/show_bug.cgi?id=1559858

Access Denied
Issue Tracking;Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-19/

Security vulnerabilities fixed in Firefox 67.0.4 and Firefox ESR 60.7.2 — Mozilla
Vendor Advisory
http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html

Mozilla Firefox Windows 64-Bit Chain Exploit ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.mozilla.org/security/advisories/mfsa2019-20/

Security vulnerabilities fixed in Thunderbird 60.7.2 — Mozilla
Vendor Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/201908-12

Mozilla Firefox: Multiple vulnerabilities (GLSA 201908-12) — Gentoo security
Third Party Advisory

CVEs referencing this url