CVE-2019-11761

MEDIUM Year: 2019
CVSS v3 Score
5.4
Medium
CVSS v2 Score
5.8
Medium
Weakness Type
CWE-362
View all →

Vulnerability Description

By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned into content. Impact from exposing this object appears to be minimal, however it was a bypass of existing defense in depth mechanisms. This vulnerability affects Firefox < 70, Thunderbird < 68.2, and Firefox ESR < 68.2.

Related Vulnerabilities

CVE-2014-0196

MEDIUM
CVSS:5.5(Medium)

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial o...

CWE-3622014

CVE-2015-7550

MEDIUM
CVSS:5.5(Medium)

The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereferen...

CWE-3622015

CVE-2016-7916

MEDIUM
CVSS:5.5(Medium)

Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file d...

CWE-3622016

CVE-2017-14483

MEDIUM
CVSS:5.5(Medium)

flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by lever...

CWE-3622017

CVE-2017-5427

MEDIUM
CVSS:5.5(Medium)

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced fi...

CWE-3622017

CVE-2017-5986

MEDIUM
CVSS:5.5(Medium)

Race condition in the sctp_wait_for_sndbuf function in net/sctp/socket.c in the Linux kernel before 4.9.11 allows local users to cause a denial of service (assertion failure and panic) via a multithre...

CWE-3622017