CVE-2019-11711

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 60.8 Firefox versions prior to 68 Thunderbird versions prior to 60.8

Description The issue arises from insufficient input validation in the document.domain component of Firefox ESR, Firefox, and the Thunderbird email client. This can be exploited by a remote attacker to perform a cross-site scripting attack. When an inner window is reused, it fails to consider the use of document.domain for cross-origin protections, allowing pages on different subdomains to inject scripts into arbitrary pages on other subdomains.

Recommendations For Firefox ESR versions prior to 60.8, update to version 60.8 or later. For Firefox versions prior to 68, update to version 68 or later. For Thunderbird versions prior to 60.8, update to version 60.8 or later.