CVE-2019-11754
published 2019-09-27CVE-2019-11754: When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the…
PriorityP417medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.62%
45.6th percentile
When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 69.0.1-1 (sid) | firefox 69.0.1-1 (sid) |
| mozilla | firefox | < 69.0.1 | 69.0.1 |
| mozilla | firefox | >= 0 < 69.0.1+build1-0ubuntu0.16.04.1 | 69.0.1+build1-0ubuntu0.16.04.1 |
| mozilla | firefox | >= 0 < 69.0.1+build1-0ubuntu0.18.04.1 | 69.0.1+build1-0ubuntu0.18.04.1 |
| mozilla | firefox | >= unspecified < 69.0.1 | 69.0.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox vulnerability
vendor_ubuntu·2019-09-25
CVE-2019-11754 Firefox vulnerability
Title: Firefox vulnerability
Summary: Firefox could be made to hijack the mouse pointer it if opened a malicious
website.
It was discovered that no user notification was given when pointer lock is
enabled. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit this to hijack the mouse pointer and
confuse users.
Instructions: After a standard system update you need to restart Firefox to make
all the necessary changes.
Red Hat
Mozilla: Pointer Lock is enabled with no user notification
vendor_redhat·2019-09-18·CVSS 4.3
CVE-2019-11754 [MEDIUM] CWE-451 Mozilla: Pointer Lock is enabled with no user notification
Mozilla: Pointer Lock is enabled with no user notification
When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1.
Package: firefox (Red Hat Enterprise Linux 5) - Out of support scope
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: firefox (Red Hat Enterprise Linux 7) - Not affected
Package: firefox (Red Hat Enterprise Linux 8) - Not affected
Debian
CVE-2019-11754: firefox - When the pointer lock is enabled by a website though requestPointerLock(), no us...
vendor_debian·2019·CVSS 4.3
CVE-2019-11754 [MEDIUM] CVE-2019-11754: firefox - When the pointer lock is enabled by a website though requestPointerLock(), no us...
When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1.
Scope: local
sid: resolved (fixed in 69.0.1-1)
GHSA
GHSA-q3j6-jpv5-vp5g: When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given
ghsa_unreviewed·2022-05-24
CVE-2019-11754 [MEDIUM] GHSA-q3j6-jpv5-vp5g: When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given
When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1.
OSV
CVE-2019-11754: When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given
osv·2019-09-19·CVSS 4.3
CVE-2019-11754 [MEDIUM] CVE-2019-11754: When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given
When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1.
No detection rules found.
No public exploits indexed.
2019-09-27
Published