Vulnerability Description
Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 70.0 |
| Mozilla | Firefox Esr | < 68.2 |
| Mozilla | Thunderbird | < 68.2 |
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1584216Issue TrackingPermissions Required
- https://security.gentoo.org/glsa/202003-10Third Party Advisory
- https://usn.ubuntu.com/4335-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-35/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1584216Issue TrackingPermissions Required
- https://security.gentoo.org/glsa/202003-10Third Party Advisory
- https://usn.ubuntu.com/4335-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-33/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-34/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-35/Vendor Advisory
FAQ
What is CVE-2019-11763?
CVE-2019-11763 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could ...
How severe is CVE-2019-11763?
CVE-2019-11763 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11763?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Canonical Ubuntu Linux.