vulnerability
Arch Linux: Access restriction bypass (CVE-2019-11747)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:N/I:P/A:N) | Sep 27, 2019 | Jul 11, 2025 | Nov 27, 2025 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Sep 27, 2019
Added
Jul 11, 2025
Modified
Nov 27, 2025
Description
The "Forget about this site" feature in the History pane is intended to remove all saved user data that indicates a user has visited a site. This includes removing any HTTP Strict Transport Security (HSTS) settings received from sites that use it. Due to a bug in Firefox before 69.0, sites on the pre-load list also have their HSTS setting removed. On the next visit to that site if the user specifies an http: URL rather than secure https: they will not be protected by the pre-loaded HSTS setting. After that visit the site's HSTS setting will be restored.
Solution
arch-linux-upgrade-latest
References
- CVE-2019-11747
- https://attackerkb.com/topics/CVE-2019-11747
- URL-http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
- URL-http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
- URL-https://bugzilla.mozilla.org/show_bug.cgi?id=1564481
- URL-https://security.archlinux.org/ASA-201909-2
- URL-https://www.mozilla.org/en-US/security/advisories/mfsa2019-25/
- URL-https://www.mozilla.org/security/advisories/mfsa2019-25/
- URL-https://www.mozilla.org/security/advisories/mfsa2019-26/
- CWE-665
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.