Vulnerability identifier: #VU33035

Vulnerability risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11715

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Firefox ESR
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Firefox ESR: 60.0 - 60.7.2

---

External links
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html
http://bugzilla.mozilla.org/show_bug.cgi?id=1555523
http://lists.debian.org/debian-lts-announce/2019/08/msg00001.html
http://lists.debian.org/debian-lts-announce/2019/08/msg00002.html
http://security.gentoo.org/glsa/201908-12
http://security.gentoo.org/glsa/201908-20
http://www.mozilla.org/security/advisories/mfsa2019-21/
http://www.mozilla.org/security/advisories/mfsa2019-22/
http://www.mozilla.org/security/advisories/mfsa2019-23/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.