CVE-2019-11717

MEDIUM 5.3CVE-2019-11717 · Published 23/07/2019 · updated 17/06/2026

In short

CVE-2019-11717 is a MEDIUM (CVSS 5.3) vulnerability affecting firefox (mozilla), thunderbird (mozilla), suse package hub for suse linux enterprise (novell).
Chance of exploitation in the next 30 days (EPSS): 2.1%, higher than 82.0% of all vulnerabilities.
Fix: update to 60.8.0, 68.0 or later.

Package	Affected versions	Patched versions
firefox mozilla	`< 60.8.0< 68.0`	`60.8.068.0`
thunderbird mozilla	`< 60.8.0`	`60.8.0`
suse package hub for suse linux enterprise novell	`= 12`	No fix yet

Description

A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being used as a separator, allowing for possible spoofing of origin attributes. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

References

lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html · Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html · Third Party Advisory
bugzilla.mozilla.org/show_bug.cgi · Exploit
lists.debian.org/debian-lts-announce/2019/08/msg00001.html · Mailing List
lists.debian.org/debian-lts-announce/2019/08/msg00002.html · Mailing List
security.gentoo.org/glsa/201908-12 · Third Party Advisory
security.gentoo.org/glsa/201908-20 · Third Party Advisory

More vulnerabilities in firefox

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free