CVE-2019-11730
Summary
| CVE | CVE-2019-11730 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-07-23 14:15:00 UTC |
| Updated | 2023-01-31 14:13:00 UTC |
| Description | A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox Esr | All | All | All | All |
| Application | Mozilla | Firefox Esr | All | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
| Application | Mozilla | Thunderbird | All | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Suse | Linux Enterprise | 12.0 | All | All | All |
| Application | Suse | Package Hub | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security vulnerabilities fixed in Firefox 68 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| [security-announce] openSUSE-SU-2019:1990-1: moderate: Security update f | SUSE | lists.opensuse.org | |
| Access Denied | MISC | bugzilla.mozilla.org | Permissions Required |
| Mozilla Firefox: Multiple vulnerabilities (GLSA 201908-12) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] [DLA 1870-1] thunderbird security update | MLIST | lists.debian.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2019:1813-1: important: Security update | SUSE | lists.opensuse.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2019:1811-1: important: Security update | SUSE | lists.opensuse.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2019:2249-1: important: Security update | SUSE | lists.opensuse.org | |
| Security vulnerabilities fixed in Firefox ESR 60.8 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| Security vulnerabilities fixed in Thunderbird 60.8 — Mozilla | MISC | www.mozilla.org | Vendor Advisory |
| Mozilla Thunderbird: Multiple vulnerabilities (GLSA 201908-20) — Gentoo security | GENTOO | security.gentoo.org | |
| [SECURITY] [DLA 1869-1] firefox-esr security update | MLIST | lists.debian.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2019:2248-1: important: Security update | SUSE | lists.opensuse.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296081 Oracle Solaris 11.4 Support Repository Update (SRU) 12.5.0 Missing (CPUJUL2019)
- 378138 Virtuozzo Linux Security Update for firefox (VZLSA-2019:1763)
- 500919 Alpine Linux Security Update for firefox-esr
- 504784 Alpine Linux Security Update for firefox-esr
- 710140 Gentoo Linux Mozilla Thunderbird Multiple vulnerabilities (GLSA 201908-20)
- 710148 Gentoo Linux Mozilla Firefox Multiple vulnerabilities (GLSA 201908-12)