Permissions, Privileges, and Access Controls in Firefox ESR and Mozilla Firefox - CVE-2019-11708

Vulnerability identifier: #VU18860

CSH Severity: High

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11708

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to bypass sandbox restrictions.

The vulnerability exists due to insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes. A remote attacker can create a specially crafted web page that can make the non-sandboxed parent process open web content chosen by a compromised child process.

An attacker can combine this behavior along with another vulnerability to execute arbitrary code on the system with privileges on the current user. 

Note, this vulnerability is being exploited in the wild along with SB2019061805 (CVE-2019-11707)

Firefox ESR
Mozilla Firefox
Arch Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Slackware Linux
Opensuse
Fedora
SUSE Package Hub for SUSE Linux Enterprise
firefox (Ubuntu package)
firefox-esr (Alpine package)
firefox-esr (Debian package)
thunderbird (Debian package)
gjs
mozjs60
firefox
mozjs68 (Alpine package)
Mozilla Thunderbird

Install updates from vendor's website.

Firefox ESR - update to 60.7.2
Mozilla Firefox - update to 67.0.4
firefox (Ubuntu package) - addressed in versions 67.0.4+build1-0ubuntu0.16.04.1, 67.0.4+build1-0ubuntu0.18.04.1, 67.0.4+build1-0ubuntu0.18.10.1, 67.0.4+build1-0ubuntu0.19.04.1
Mozilla Thunderbird - update to 60.7.2
firefox-esr (Alpine package) - update to 60.7.2-r0
firefox-esr (Debian package) - update to 60.7.2esr-1~deb9u1
thunderbird (Debian package) - update to 1:60.7.2-1~deb9u1
gjs - update to 1.56.2-4.fc30
mozjs60 - update to 60.7.2-1.fc30
firefox - addressed in versions 67.0.4-1.fc29, 67.0.4-1.fc30
mozjs68 (Alpine package) - update to 68.4.1-r0

• Exploit #7818 - Mozilla Firefox 67 - Array.pop JIT Type Confusion (May 13, 2022)
• Exploit #5829 - Mozilla FireFox (Windows 10 x64) - Full Chain Client Side Attack (June 17, 2021)
• Exploit #1869 - CVE-2019-11708 (Full exploit chain (CVE-2019-11708 & CVE-2019-9810) against Firefox on Windows 64-bit.) (March 18, 2020)

• https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/
• https://twitter.com/5aelo/status/1141273394723414016
• https://twitter.com/SecurityGuyPhil/status/1141466335592869888

• Security restrictions bypass in Mozilla Firefox and Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Slackware Linux update for mozilla-firefox
• OpenSUSE Linux update for MozillaThunderbird
• OpenSUSE Linux update for MozillaThunderbird
• OpenSUSE Linux update for MozillaFirefox
• Arch Linux update for firefox
• Debian update for thunderbird
• Ubuntu update for Firefox
• OpenSUSE Linux update for MozillaThunderbird
• Debian update for firefox-esr
• Red Hat update for thunderbird
• Red Hat update for thunderbird
• Red Hat update for firefox
• Red Hat update for firefox
• Red Hat update for firefox
• Red Hat update for thunderbird
• Permissions, Privileges, and Access Controls in mozjs68 (Alpine package)
• Permissions, Privileges, and Access Controls in firefox-esr (Alpine package)
• Fedora 30 update for gjs, mozjs60
• Fedora 29 update for firefox
• Fedora 30 update for firefox