Medium severity6.5NVD Advisory· Published Jul 23, 2019· Updated Jun 17, 2026
CVE-2019-11730
CVE-2019-11730
Description
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other files in the same directory or sub-directories if the names are known or guessed. The Fetch API can then be used to read the contents of any files stored in these directories and they may uploaded to a server. It was demonstrated that in combination with a popular Android messaging app, if a malicious HTML attachment is sent to a user and they opened that attachment in Firefox, due to that app's predictable pattern for locally-saved file names, it is possible to read attachments the victim received from other correspondents. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
101- osv-coords89 versionspkg:rpm/opensuse/mozilla-nss&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/MozillaFirefox-branding-SLED&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/firefox-atk&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/firefox-cairo&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/firefox-gtk3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/firefox-harfbuzz&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/firefox-libffi&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/firefox-libffi-gcc5&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/mozilla-nss&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/mozilla-nss&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP1pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweedpkg:rpm/suse/firefox-gdk-pixbuf&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweedpkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/MozillaThunderbird&distro=SUSE%20Package%20Hub%2012pkg:rpm/suse/firefox-glib2&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP1pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/firefox-pango&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/mozilla-nspr&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/mozilla-nss&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/mozilla-nss&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/mozilla-nss&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015pkg:rpm/suse/mozilla-nss&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/MozillaFirefox&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/MozillaFirefox-branding-SLE&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.1pkg:rpm/opensuse/mozilla-nss&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/enigmail&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/enigmail&distro=openSUSE%20Leap%2015.1
< 3.44.1-lp151.2.3.1+ 88 more
- (no CPE)range: < 3.44.1-lp151.2.3.1
- (no CPE)range: < 60.8.0-lp151.2.10.1
- (no CPE)range: < 60.8.0-lp151.2.10.1
- (no CPE)range: < 60.8.0esr-78.43.2
- (no CPE)range: < 68-21.9.8
- (no CPE)range: < 2.26.1-2.8.4
- (no CPE)range: < 1.15.10-2.13.4
- (no CPE)range: < 3.10.9-2.15.3
- (no CPE)range: < 1.7.5-2.7.4
- (no CPE)range: < 3.2.1.git259-2.3.3
- (no CPE)range: < 5.3.1+r233831-14.1
- (no CPE)range: < 3.45-38.9.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 3.44.1-3.16.2
- (no CPE)range: < 3.44.1-3.16.2
- (no CPE)range: < 3.44.1-3.16.2
- (no CPE)range: < 60.8.0-3.46.2
- (no CPE)range: < 60.8.0-3.46.2
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 92.0-1.2
- (no CPE)range: < 2.36.11-2.8.4
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 128.5.1-1.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68.1.0-109.89.1
- (no CPE)range: < 60.8.0-88.1
- (no CPE)range: < 2.54.3-2.14.7
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 60.8.0-3.51.4
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68.1.0-109.89.1
- (no CPE)range: < 68.1.0-109.89.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 1.40.14-2.7.4
- (no CPE)range: < 4.21-29.6.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-3.51.4
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 3.44.1-58.28.1
- (no CPE)range: < 60.8.0-109.83.3
- (no CPE)range: < 68-32.8.1
- (no CPE)range: < 91.1.1-1.1
- (no CPE)range: < 60.8.0-lp151.2.10.1
- (no CPE)range: < 3.44.1-lp150.2.24.1
- (no CPE)range: < 2.1.2-lp150.34.1
- (no CPE)range: < 2.1.2-lp151.2.6.1
unspecified+ 4 more
- (no CPE)range: unspecified
- (no CPE)range: unspecified
- (no CPE)range: <60.8
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*range: <68.0
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*range: <60.8
unspecified+ 2 more
- (no CPE)range: unspecified
- (no CPE)range: <60.8
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <60.8
- cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
13- lists.opensuse.org/opensuse-security-announce/2019-07/msg00055.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-07/msg00058.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00073.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00009.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00010.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/08/msg00001.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/08/msg00002.htmlnvdMailing ListThird Party Advisory
- security.gentoo.org/glsa/201908-12nvdThird Party Advisory
- security.gentoo.org/glsa/201908-20nvdThird Party Advisory
- www.mozilla.org/security/advisories/mfsa2019-21/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-22/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2019-23/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdIssue TrackingPermissions Required
News mentions
0No linked articles in our index yet.