// For flags

CVE-2019-9811

Mozilla Firefox Language Pack XUL Injection Sandbox Escape Vulnerability

Severity Score

8.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack and then opening a browser feature that used the compromised translation. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Como parte de una entrada Pwn2Own ganadora, un investigador demostró un escape del sandbox mediante la instalación de un paquete de idioma malicioso y luego abriendo una funcionalidad del navegador que usaba la traducción comprometida. Esta vulnerabilidad afecta a Firefox ESR anterior a versión 60.8, Firefox anterior a versión 68 y Thunderbird anterior a versión 60.8.

This vulnerability allows remote attackers to escape the sandbox on affected installations of Mozilla Firefox. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists due to possibility of XUL injection via language pack. An attacker can leverage this vulnerability to escape the sandbox and execute code at medium integrity.

*Credits: Niklas Baumstark (@_niklasb)
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-03-14 CVE Reserved
  • 2019-07-10 CVE Published
  • 2024-07-16 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-807: Reliance on Untrusted Inputs in a Security Decision
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mozilla
Search vendor "Mozilla"
 Firefox
Search vendor "Mozilla" for product "Firefox"
 < 68.0
Search vendor "Mozilla" for product "Firefox" and version " < 68.0"
-
Affected
Mozilla
Search vendor "Mozilla"
 Firefox Esr
Search vendor "Mozilla" for product "Firefox Esr"
 < 60.8
Search vendor "Mozilla" for product "Firefox Esr" and version " < 60.8"
-
Affected
Mozilla
Search vendor "Mozilla"
 Thunderbird
Search vendor "Mozilla" for product "Thunderbird"
 < 60.8
Search vendor "Mozilla" for product "Thunderbird" and version " < 60.8"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Novell
Search vendor "Novell"
 Suse Package Hub For Suse Linux Enterprise
Search vendor "Novell" for product "Suse Package Hub For Suse Linux Enterprise"
 12
Search vendor "Novell" for product "Suse Package Hub For Suse Linux Enterprise" and version "12"
-
Affected
Opensuse
Search vendor "Opensuse"
 Leap
Search vendor "Opensuse" for product "Leap"
 15.0
Search vendor "Opensuse" for product "Leap" and version "15.0"
-
Affected
Opensuse
Search vendor "Opensuse"
 Leap
Search vendor "Opensuse" for product "Leap"
 15.1
Search vendor "Opensuse" for product "Leap" and version "15.1"
-
Affected