Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-11748: Firefox (ESR) may reuse camera and mic permission
CVE-2019-11748 · published 7 years ago
Summary
Firefox versions before 69 (and the extended support version before 68.1) can keep a user’s earlier approval for microphone or camera access even when a site is embedded inside another page. This could let hidden content use those devices without asking again. Updating Firefox to the latest version resolves the issue, as the browser now asks for permission each time.
What to do
- Update debian firefox-esr to version 68.1.0esr-1.
- Update mozilla firefox to version 69.0 or later.
- Update mozilla firefox_esr to version 68.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | firefox-esr |
< 68.1.0esr-1 Fix: upgrade to 68.1.0esr-1
|
| Debian:13 | debian | firefox-esr |
< 68.1.0esr-1 Fix: upgrade to 68.1.0esr-1
|
| Debian:14 | debian | firefox-esr |
< 68.1.0esr-1 Fix: upgrade to 68.1.0esr-1
|
| – | mozilla | firefox |
< 69.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| – | mozilla | firefox_esr |
< 68.1.0 cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
Original advisory text
WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities i...
WebRTC in Firefox will honor persisted permissions given to sites for access to microphone and camera resources even when in a third-party context. In light of recent high profile vulnerabilities in other software, a decision was made to no longer persist these permissions. This avoids the possibility of trusted WebRTC resources being invisibly embedded in web content and abusing permissions previously given by users. Users will now be prompted for permissions on each use. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.
References
- https://security-tracker.debian.org/tracker/CVE-2019-11748 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00017.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=1564588 Issue Tracking Permissions Required Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-25/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2019-26/ Vendor Advisory
Severity
6.5
Medium
Type
CWE-281Improper Preservation of Permissions
Timeline
Published27 Sep 2019
Updated31 Oct 2026
First seen21 Sep 2026
Track software like this
Free during beta