CVE-2019-11728

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that the accessible to a user when web content is loaded. This vulnerability affects Firefox < 68.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 68

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1552993Issue Tracking, Permissions Required, Vendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.htmlMailing List, Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1552993Issue Tracking, Permissions Required, Vendor Advisory
https://security.gentoo.org/glsa/201908-12Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2019-21/Vendor Advisory

Timeline

Published: Jul 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-117297.5Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before being copied into mem CVE-2019-11737.0An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successf CVE-2019-117306.5A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same direc CVE-2019-117339.8When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It w CVE-2019-117349.8Mozilla developers and community members reported memory safety bugs present in Firefox 68. Some of these bugs showed evidence of memory cor CVE-2019-117358.8Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evi CVE-2019-117367.0The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the rep CVE-2019-117375.3If a wildcard ('*') is specified for the host in Content Security Policy (CSP) directives, any port or path restriction of the directive wil CVE-2019-117386.3If a Content Security Policy (CSP) directive is defined that uses a hash-based source that takes the empty string as input, execution of any CVE-2019-117396.5Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a HTML reply/forward. This vulnerabi CVE-2019-11747.0An elevation of privilege vulnerability exists in the way that the PsmServiceExtHost.dll handles objects in memory. An attacker who successf CVE-2019-117408.8Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8. Some of these