CVE-2019-11763

CVE Details

Release Date:

2020-01-08

Description

Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

See more information about CVE-2019-11763 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	6.1	Base Metrics:	AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Access Vector:	Network	Attack Complexity:	Low
Privileges Required:	None	User Interaction:	Required
Scope:	Changed	Confidentiality Impact:	Low
Integrity Impact:	Low	Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (firefox)	ELSA-2019-3281	2020-07-07
Oracle Linux version 7 (firefox)	ELSA-2019-3193	2019-10-23
Oracle Linux version 7 (thunderbird)	ELSA-2019-3210	2019-10-29
Oracle Linux version 8 (firefox)	ELSA-2019-3196	2019-10-24
Oracle Linux version 8 (thunderbird)	ELSA-2019-3237	2019-10-30

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team