CVE-2019-11700

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. *Note: this issue only occurs on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 67.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 67

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1549833Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1549833Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117016.1The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place a CVE-2019-117026.5A hyperlink using protocols associated with Internet Explorer, such as IE.HTTP:, can be used to open local files at a known location with In CVE-2019-117039.8A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in parser_get_next_char when processing certain email messages,CVE-2019-117049.8A flaw in Thunderbird's implementation of iCal causes a heap buffer overflow in icalmemory_strdup_and_dequote when processing certain email CVE-2019-117059.8A flaw in Thunderbird's implementation of iCal causes a stack buffer overflow in icalrecur_add_bydayrules when processing certain email mess CVE-2019-117067.5A flaw in Thunderbird's implementation of iCal causes a type confusion in icaltimezone_get_vtimezone_properties when processing certain emai CVE-2019-117078.8A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable CVE-2019-1170810.0Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxe CVE-2019-117099.8Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed e CVE-2019-11715.6An information disclosure vulnerability exists in SymCrypt during the OAEP decryption stage. An attacker who successfully exploited this vul CVE-2019-117109.8Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed evidence of memory cor CVE-2019-117118.8When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomai