CVE-2019-11725

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation is interrupted but resources from the same site loaded through websockets are not blocked, leading to the loading of unsafe resources and bypassing safebrowsing protections. This vulnerability affects Firefox < 68.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 68

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1483510Issue Tracking, Permissions Required, Vendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1483510Issue Tracking, Permissions Required, Vendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117275.3A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when CVE-2019-117284.7The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a us CVE-2019-117297.5Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into mem CVE-2019-11737.0An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successf CVE-2019-117306.5A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direc CVE-2019-117339.8When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It w CVE-2019-117349.8Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory cor CVE-2019-117358.8Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evi CVE-2019-117367.0The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the rep CVE-2019-117375.3If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive wil CVE-2019-117386.3If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any CVE-2019-117396.5Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerabi