CVE-2019-13075

NameCVE-2019-13075
DescriptionTor Browser through 8.5.3 has an information exposure vulnerability. It allows remote attackers to detect the browser's language via vectors involving an IFRAME element, because text in that language is included in the title attribute of a LINK element for a non-HTML page. This is related to a behavior of Firefox before 68.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firefox (PTS)sid70.0.1-1fixed
firefox-esr (PTS)jessie52.8.1esr-1~deb8u1vulnerable
jessie (security)68.2.0esr-1~deb8u1vulnerable
stretch60.7.1esr-1~deb9u1vulnerable
stretch (security)68.2.0esr-1~deb9u2vulnerable
buster60.8.0esr-1~deb10u1vulnerable
buster (security)68.2.0esr-1~deb10u1vulnerable
bullseye, sid68.2.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firefoxsource(unstable)68.0-1unimportant
firefox-esrsource(unstable)68.2.0esr-1unimportant

Notes

https://hackerone.com/reports/588239
https://trac.torproject.org/projects/tor/ticket/30657
This affects Firefox, but it's not a security issue in Firefox by itself

Search for package or bug name: Reporting problems