Vulnerability Description
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-site scripting (XSS) filtering. This vulnerability affects Firefox < 68.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 68.0 |
| Opensuse | Leap | 15.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing ListThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1556230Issue TrackingPermissions RequiredVendor Advisory
- https://security.gentoo.org/glsa/201908-12Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing ListThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1556230Issue TrackingPermissions RequiredVendor Advisory
- https://security.gentoo.org/glsa/201908-12Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
FAQ
What is CVE-2019-11720?
CVE-2019-11720 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering parsing errors. This allows malicious code to then be processed, evading cross-sit...
How severe is CVE-2019-11720?
CVE-2019-11720 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11720?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Opensuse Leap.