CVE-2019-11696 - Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system

Back Back to CVE browser

HIGH

Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system

Published Jul 23, 2019

7.8

HIGH

CVSS 3.0

EPSS 0.84%

Description

Files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. This vulnerability affects Firefox < 67.

Affected products

Vendor Mozilla Product Firefox Default
unknown
Affected
- ≥ unspecified, < 67

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Mozilla	Firefox	unknown	Affected ≥ unspecified, < 67

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=1392955
x_refsource_MISCExploitIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3366
Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1392955		x_refsource_MISCExploitIssue TrackingVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3366		Advisory
https://www.mozilla.org/security/advisories/mfsa2019-13/		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mozilla

Published Jul 23, 2019

Updated Aug 4, 2024

Reserved May 3, 2019

Link CVE-2019-11696

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-11696

Red Hat

No data

ENISA EUVD

Assigner mozilla

Published Jul 23, 2019

Updated Aug 4, 2024

Link EUVD-2019-3366

GitHub

No data