CVE-2019-13075

NameCVE-2019-13075
DescriptionTor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid68.0.2-3vulnerable
firefox-esr (PTS)jessie52.8.1esr-1~deb8u1vulnerable
jessie (security)60.8.0esr-1~deb8u1vulnerable
stretch60.6.1esr-1~deb9u1vulnerable
stretch (security)60.8.0esr-1~deb9u1vulnerable
buster60.7.2esr-1vulnerable
buster (security)60.8.0esr-1~deb10u1vulnerable
bullseye60.8.0esr-1vulnerable
sid68.0.2esr-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)(unfixed)unimportant
firefox-esrsource(unstable)(unfixed)unimportant

Notes

https://hackerone.com/reports/588239
https://trac.torproject.org/projects/tor/ticket/30657
This affects Firefox, but it's not a security issue in Firefox by itself

Search for package or bug name: Reporting problems