Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefoxUpgrade firefox-esr | Nov 8, 2019 | Sep 27, 2019 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade thunderbird | Apr 27, 2020 | Sep 27, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 27, 2019 |
| Centos_linux | — | Upgrade firefoxUpgrade thunderbirdUpgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade firefox-debugsource | Sep 5, 2019 | Sep 4, 2019 |
| Debian | — | Upgrade thunderbirdUpgrade firefox-esr | Sep 9, 2019 | Sep 9, 2019 |
| Freebsd | — | Upgrade thunderbirdUpgrade firefoxUpgrade linux-thunderbirdUpgrade libxulUpgrade firefox-esrUpgrade seamonkeyUpgrade linux-firefoxUpgrade linux-seamonkeyUpgrade waterfox | Sep 4, 2019 | Sep 3, 2019 |
| Gentoo Linux | — | Upgrade www-client/firefox.Upgrade www-client/firefox-bin. | Nov 25, 2019 | Sep 27, 2019 |
| Mfsa2019 25 | — | Upgrade to Mozilla Firefox version 69.0 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 26 | — | Upgrade to Mozilla Firefox ESR version 68.1 | Sep 4, 2019 | Sep 3, 2019 |
| Mfsa2019 27 | — | Upgrade to Mozilla Firefox ESR version 60.9 | Sep 4, 2019 | Sep 3, 2019 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 68.1 | Sep 16, 2021 | Sep 27, 2019 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4Upgrade web/browser/firefox to version 60.9.0-11.4.14.0.1.2.0 on Solaris 11.4Upgrade mail/thunderbird to version 60.9.0-11.4.14.0.1.3.0 on Solaris 11.4 | Oct 16, 2019 | Sep 27, 2019 |
| Oracle_linux | — | Upgrade thunderbirdUpgrade firefox | Sep 11, 2019 | Sep 3, 2019 |
| Redhat_linux | — | Upgrade thunderbirdUpgrade firefoxNo solution existsUpgrade firefox-debuginfoUpgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade firefox-debugsource | Sep 5, 2019 | Sep 4, 2019 |
| Suse | — | Upgrade mozillafirefox-branding-sleUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillathunderbird-translations-commonUpgrade libfreebl3Upgrade libfirefox-gthread-2_0-0Upgrade mozilla-nspr-develUpgrade mozilla-nsprUpgrade mozillafirefox-translations-otherUpgrade enigmailUpgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nspr-32bitUpgrade libsoftokn3Upgrade MozillaThunderbird-buildsymbolsUpgrade mozillafirefox-translations-commonUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-inuktitutUpgrade libsoftokn3-32bitUpgrade mozillafirefox-branding-sledUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-amharicUpgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-langUpgrade mozillafirefox-branding-upstreamUpgrade firefox-libcairo-gobject2Upgrade mozillafirefox-develUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade mozilla-nss-certsUpgrade firefox-libffi4Upgrade firefox-libffi7Upgrade mozillathunderbirdUpgrade mozilla-nss-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libcairo2Upgrade mozilla-nss-32bitUpgrade libfirefox-gio-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozillathunderbird-translations-otherUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-ximUpgrade firefox-atk-langUpgrade firefox-glib2-toolsUpgrade libfirefox-gobject-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade mozillafirefoxUpgrade firefox-libpango-1_0-0Upgrade mozillafirefox-buildsymbolsUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gio-branding-upstream | Sep 18, 2019 | Sep 3, 2019 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefox | Sep 5, 2019 | Sep 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub