{"schema_version":"1.7.5","id":"CVE-2019-11708","published":"2019-07-23T14:15:15.327Z","modified":"2026-04-16T04:31:44.891034055Z","related":["SUSE-SU-2019:14124-1","SUSE-SU-2019:1682-1","SUSE-SU-2019:1683-1","SUSE-SU-2019:1684-1","openSUSE-SU-2019:1595-1","openSUSE-SU-2019:1606-1","openSUSE-SU-2019:1664-1","openSUSE-SU-2024:10600-1","openSUSE-SU-2024:10601-1","openSUSE-SU-2024:14572-1"],"details":"Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2.","affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11708.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"fixed":"60.7.2"}]},{"events":[{"introduced":"0"},{"fixed":"67.0.4"}]},{"events":[{"introduced":"0"},{"fixed":"60.7.2"}]}]}}],"references":[{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11708"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201908-12"},{"type":"ADVISORY","url":"https://www.mozilla.org/security/advisories/mfsa2019-19/"},{"type":"ADVISORY","url":"https://www.mozilla.org/security/advisories/mfsa2019-20/"},{"type":"ADVISORY","url":"http://packetstormsecurity.com/files/155592/Mozilla-Firefox-Windows-64-Bit-Chain-Exploit.html"},{"type":"REPORT","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1559858"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}