CVE-2019-11708 Mozilla Firefox and Thunderbird Sandbox Escape
Insufficient parameter vetting in IPC allows a compromised child process to force the parent to open web content, potentially leading to arbitrary code execution.
- Exploited in the wild
- Since 23 May 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11708?
CVE-2019-11708 is a critical vulnerability in Mozilla Firefox, published on 23 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.
Weakness: CWE-20
Which versions are affected by CVE-2019-11708?
It affects 2 products.
Linux distribution packages (22)
MozillaFirefox SUSE:Enterprise Storage 4 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Enterprise Storage 5 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Module for Desktop Applications 15 | All versions | 60.7.2-3.48.1 |
MozillaFirefox SUSE:Linux Enterprise Module for Desktop Applications 15 SP1 | All versions | 60.7.2-3.48.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP3 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12 SP4 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server 12-LTSS | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:OpenStack Cloud 7 | All versions | 60.7.2-109.80.1 |
MozillaFirefox SUSE:OpenStack Cloud 8 | All versions | 60.7.2-109.80.1 |
MozillaFirefox openSUSE:Leap 15.1 | All versions | 60.7.2-lp151.2.7.1 |
Products include Mozilla Firefox, Mozilla Thunderbird.
How do I fix CVE-2019-11708?
Upgrade to a fixed version. US federal agencies must fix it by 13 Jun 2022.
Is CVE-2019-11708 being exploited?
Yes. Attackers have exploited CVE-2019-11708 in the wild since at least 23 May 2022.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Mozilla Firefox
Sources
Also known as ALPINE-CVE-2019-11708, DEBIAN-CVE-2019-11708, DSA-4474-1, GHSA-w2hj-6j62-2w9f, MGASA-2019-0202, SUSE-SU-2019:1682-1 and 4 more.