CVE-2019-11749

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A vulnerability exists in WebRTC where malicious web content can use probing techniques on the getUserMedia API using constraints to reveal device properties of cameras on the system without triggering a user prompt or notification. This allows for the potential fingerprinting of users. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 69
Mozilla	Firefox ESR	>= unspecified, < 68.1

References

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1565374Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-25/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-26/Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
https://bugzilla.mozilla.org/show_bug.cgi?id=1565374Issue Tracking, Permissions Required, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-25/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2019-26/Vendor Advisory

Timeline

Published: Sep 27, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-11757.0An elevation of privilege vulnerability exists in the way that the psmsrv.dll handles objects in memory. An attacker who successfully exploi CVE-2019-117506.5A type confusion vulnerability exists in Spidermonkey, which results in a non-exploitable crash. This vulnerability affects Firefox < 69 and CVE-2019-117518.8Logging-related command line parameters are not properly sanitized when Firefox is launched by another program, such as when a user clicks o CVE-2019-117528.8It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This results in a use-after-free and a CVE-2019-117537.8The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it unprotected from manipulation by unprivi CVE-2019-117544.3When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious websi CVE-2019-117557.5A crafted S/MIME message consisting of an inner encryption layer and an outer SignedData layer was shown as having a valid digital signature CVE-2019-117568.8Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). This vuln CVE-2019-117578.8When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequently reference it. Thi CVE-2019-117588.8Mozilla community member Philipp reported a memory safety bug present in Firefox 68 when 360 Total Security was installed. This bug showed e CVE-2019-117598.8An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an at CVE-2019-11767.0An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory. An attacker who successfully exploited thi