ByteOS Network

NVD Vulnerability Details :

CVE-2019-11763

Analyzed

Source-security@mozilla.org

Published At-08 Jan, 2020 | 20:15

Updated At-03 Feb, 2023 | 17:27

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Mozilla Corporation

>>firefox>>Versions before 70.0(exclusive)

cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*

Mozilla Corporation

>>firefox_esr>>Versions before 68.2(exclusive)

cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*

Mozilla Corporation

>>thunderbird>>Versions before 68.2(exclusive)

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1584216	security@mozilla.org	Issue Tracking Permissions Required
https://security.gentoo.org/glsa/202003-10	security@mozilla.org	Third Party Advisory
https://usn.ubuntu.com/4335-1/	security@mozilla.org	Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-33/	security@mozilla.org	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-34/	security@mozilla.org	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-35/	security@mozilla.org	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History