When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog. It was found that locally stored passwords can be copied to the clipboard thorough the 'copy password' context menu item without re-entering the master password if the master password had been previously entered in the same session, allowing for potential theft of stored passwords. This vulnerability affects Firefox < 68.0.2 and Firefox ESR < 68.0.2.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade librewolfUpgrade firefox-esrUpgrade firefox | Aug 22, 2024 | Sep 27, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2019 |
| Centos_linux | — | Upgrade firefoxUpgrade firefox-debuginfoUpgrade firefox-debugsource | Sep 11, 2019 | Sep 10, 2019 |
| Freebsd | — | Upgrade cliqzUpgrade firefox | Aug 29, 2019 | Aug 28, 2019 |
| Mfsa2019 24 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 68.0.2Upgrade to Mozilla Firefox version 68.0.2 | Aug 15, 2019 | Aug 14, 2019 |
| Oracle_linux | — | Upgrade firefox | Sep 11, 2019 | Aug 14, 2019 |
| Redhat_linux | — | Upgrade firefox-debuginfoUpgrade firefox-debugsourceUpgrade firefox | Sep 11, 2019 | Sep 10, 2019 |
| Suse | — | Upgrade mozilla-nss-develUpgrade firefox-gtk3-langUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nspr-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libatk-1_0-0Upgrade mozilla-nssUpgrade libsoftokn3Upgrade mozilla-nss-toolsUpgrade firefox-libcairo2Upgrade firefox-gtk3-dataUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nspr-32bitUpgrade MozillaFirefox-develUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-glib2-langUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-toolsUpgrade firefox-libharfbuzz0Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-atk-langUpgrade libfirefox-gio-2_0-0Upgrade mozillafirefox-buildsymbolsUpgrade libfreebl3Upgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libffi7Upgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozillafirefox-branding-upstreamUpgrade firefox-libffi4Upgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade libfirefox-glib-2_0-0Upgrade firefox-glib2-toolsUpgrade mozillafirefox-branding-sleUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nss-certsUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-32bitUpgrade mozilla-nsprUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libpango-1_0-0 | Oct 8, 2019 | Aug 16, 2019 |
| Ubuntu | — | Upgrade firefox | Aug 17, 2019 | Aug 16, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub