CVE-2019-11711
Summary
| CVE | CVE-2019-11711 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-07-23 14:15:00 UTC |
| Updated | 2023-03-01 16:39:00 UTC |
| Description | When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox Esr | All | All | All | All |
| Application | Mozilla | Firefox Esr | All | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security vulnerabilities fixed in Firefox 68 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| [security-announce] openSUSE-SU-2019:1990-1: moderate: Security update f | SUSE | lists.opensuse.org | |
| Mozilla Firefox: Multiple vulnerabilities (GLSA 201908-12) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] [DLA 1870-1] thunderbird security update | MLIST | lists.debian.org | |
| [security-announce] openSUSE-SU-2019:1813-1: important: Security update | SUSE | lists.opensuse.org | |
| [security-announce] openSUSE-SU-2019:1811-1: important: Security update | SUSE | lists.opensuse.org | |
| 1552541 - (CVE-2019-11711) Inner window reuse does not play nicely with document.domain | MISC | bugzilla.mozilla.org | Issue Tracking, Permissions Required, Vendor Advisory |
| [security-announce] openSUSE-SU-2019:2249-1: important: Security update | SUSE | lists.opensuse.org | |
| Security vulnerabilities fixed in Firefox ESR 60.8 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| Security vulnerabilities fixed in Thunderbird 60.8 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| Mozilla Thunderbird: Multiple vulnerabilities (GLSA 201908-20) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] [DLA 1869-1] firefox-esr security update | MLIST | lists.debian.org | |
| [security-announce] openSUSE-SU-2019:2248-1: important: Security update | SUSE | lists.opensuse.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296081 Oracle Solaris 11.4 Support Repository Update (SRU) 12.5.0 Missing (CPUJUL2019)
- 378138 Virtuozzo Linux Security Update for firefox (VZLSA-2019:1763)
- 500919 Alpine Linux Security Update for firefox-esr
- 504784 Alpine Linux Security Update for firefox-esr
- 710140 Gentoo Linux Mozilla Thunderbird Multiple vulnerabilities (GLSA 201908-20)
- 710148 Gentoo Linux Mozilla Firefox Multiple vulnerabilities (GLSA 201908-12)