{"containers": {"cna": {"affected": [{"product": "Firefox", "vendor": "Mozilla", "versions": [{"lessThan": "69", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThan": "68.1", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "60.9", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "Firefox ESR", "vendor": "Mozilla", "versions": [{"lessThan": "60.9", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "68.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Navigation events were not fully adhering to the W3C's \"Navigation-Timing Level 2\" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1."}], "problemTypes": [{"descriptions": [{"description": "Cross-origin access to unload event attributes", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-11-25T01:07:05", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1560495"}, {"tags": ["x_refsource_MISC"], "url": "https://w3c.github.io/navigation-timing"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-27/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-26/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-29/"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-30/"}, {"name": "openSUSE-SU-2019:2248", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html"}, {"name": "openSUSE-SU-2019:2249", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html"}, {"name": "openSUSE-SU-2019:2251", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html"}, {"name": "openSUSE-SU-2019:2260", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html"}, {"name": "USN-4150-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://usn.ubuntu.com/4150-1/"}, {"name": "GLSA-201911-07", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201911-07"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2019-11743", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Firefox", "version": {"version_data": [{"version_affected": "<", "version_value": "69"}]}}, {"product_name": "Thunderbird", "version": {"version_data": [{"version_affected": "<", "version_value": "68.1"}, {"version_affected": "<", "version_value": "60.9"}]}}, {"product_name": "Firefox ESR", "version": {"version_data": [{"version_affected": "<", "version_value": "60.9"}, {"version_affected": "<", "version_value": "68.1"}]}}]}, "vendor_name": "Mozilla"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Navigation events were not fully adhering to the W3C's \"Navigation-Timing Level 2\" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-origin access to unload event attributes"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1560495", "refsource": "MISC", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1560495"}, {"name": "https://w3c.github.io/navigation-timing", "refsource": "MISC", "url": "https://w3c.github.io/navigation-timing"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2019-25/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2019-27/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2019-27/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2019-26/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2019-26/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2019-29/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2019-29/"}, {"name": "https://www.mozilla.org/security/advisories/mfsa2019-30/", "refsource": "CONFIRM", "url": "https://www.mozilla.org/security/advisories/mfsa2019-30/"}, {"name": "openSUSE-SU-2019:2248", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html"}, {"name": "openSUSE-SU-2019:2249", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html"}, {"name": "openSUSE-SU-2019:2251", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html"}, {"name": "openSUSE-SU-2019:2260", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html"}, {"name": "USN-4150-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/4150-1/"}, {"name": "GLSA-201911-07", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201911-07"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T23:03:32.640Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1560495"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://w3c.github.io/navigation-timing"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-27/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-26/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-29/"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-30/"}, {"name": "openSUSE-SU-2019:2248", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html"}, {"name": "openSUSE-SU-2019:2249", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html"}, {"name": "openSUSE-SU-2019:2251", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html"}, {"name": "openSUSE-SU-2019:2260", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html"}, {"name": "USN-4150-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "https://usn.ubuntu.com/4150-1/"}, {"name": "GLSA-201911-07", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201911-07"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2019-11743", "datePublished": "2019-09-27T17:17:50", "dateReserved": "2019-05-03T00:00:00", "dateUpdated": "2024-08-04T23:03:32.640Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "299AA921-46BD-4E9F-8D74-F304F44C6EB4", "versionEndExcluding": "69.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "374FD799-289B-4AD5-867D-5249DDD4C88E", "versionEndExcluding": "60.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE2AF870-C78F-49CA-B92B-F2E82F1C0B98", "versionEndExcluding": "68.1.0", "versionStartIncluding": "68.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "6767554B-7534-4C6A-8E34-F389CD3B8934", "versionEndExcluding": "60.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BA30451-E9AB-4FAE-AA49-91FCCFBE3377", "versionEndExcluding": "68.1.0", "versionStartIncluding": "68.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Navigation events were not fully adhering to the W3C's \"Navigation-Timing Level 2\" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1."}, {"lang": "es", "value": "Los eventos de navegaci\u00f3n no se adhirieron totalmente a la especificaci\u00f3n borrador del \"Navigation-Timing Level 2\" de W3C en algunas instancias para el evento de descarga, que restringe el acceso a los atributos de sincronizaci\u00f3n detallados para que solo sean del mismo origen. Esto result\u00f3 en una posible exposici\u00f3n de informaci\u00f3n de origen cruzado mediante la sincronizaci\u00f3n de ataques de canal lateral. Esta vulnerabilidad afecta a Firefox versiones anteriores a 69, Thunderbird versiones anteriores a 68.1, Thunderbird versiones anteriores a 60.9, Firefox versiones anteriores a 60.9 y Firefox ESR versiones anteriores a 68.1."}], "id": "CVE-2019-11743", "lastModified": "2020-08-24T17:37:01.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-27T18:15:12.037", "references": [{"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html"}, {"source": "security@mozilla.org", "tags": ["Issue Tracking", "Permissions Required", "Vendor Advisory"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1560495"}, {"source": "security@mozilla.org", "url": "https://security.gentoo.org/glsa/201911-07"}, {"source": "security@mozilla.org", "url": "https://usn.ubuntu.com/4150-1/"}, {"source": "security@mozilla.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://w3c.github.io/navigation-timing"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-25/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-26/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-27/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-29/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2019-30/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Yoav Weiss as the original reporter.", "affected_release": [{"advisory": "RHSA-2019:2694", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "firefox-0:60.9.0-1.el6_10", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2019-09-12T00:00:00Z"}, {"advisory": "RHSA-2019:2807", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "thunderbird-0:60.9.0-1.el6_10", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2019-09-19T00:00:00Z"}, {"advisory": "RHSA-2019:2729", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "firefox-0:60.9.0-1.el7_7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2019-09-12T00:00:00Z"}, {"advisory": "RHSA-2019:2773", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "thunderbird-0:60.9.0-1.el7_7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2019-09-19T00:00:00Z"}, {"advisory": "RHSA-2019:2663", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "firefox-0:68.1.0-1.el8_0", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2019-09-04T00:00:00Z"}, {"advisory": "RHSA-2019:2774", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:60.9.0-2.el8_0", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2019-09-16T00:00:00Z"}], "bugzilla": {"description": "Mozilla: Cross-origin access to unload event attributes", "id": "1748654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1748654"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-829", "details": ["Navigation events were not fully adhering to the W3C's \"Navigation-Timing Level 2\" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin. This resulted in potential cross-origin information exposure of history through timing side-channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1."], "name": "CVE-2019-11743", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Out of support scope", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2019-09-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-11743\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-11743\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-27/#CVE-2019-11743"], "statement": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it may present a risk in browser-like contexts.", "threat_severity": "Moderate", "upstream_fix": "thunderbird 60.9, firefox 60.9, firefox 68.1"}