When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability affects Firefox < 69.0.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When the pointer lock is enabled by a website though requestPointerLock(), no user notification is given.
    This could allow a malicious website to hijack the mouse pointer and confuse users. This vulnerability     affects Firefox < 69.0.1. (CVE-2019-11754)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4140-1 advisory.

    It was discovered that no user notification was given when pointer lock is enabled. If a user were tricked     in to opening a specially crafted website, an attacker could potentially exploit this to hijack the mouse     pointer and confuse users.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 69.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-31 advisory.

  - When the pointer lock is enabled by a website though <code>requestPointerLock()</code>, no user     notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users.
    (CVE-2019-11754)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 69.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2019-31 advisory.

  - When the pointer lock is enabled by a website though <code>requestPointerLock()</code>, no user     notification is given. This could allow a malicious website to hijack the mouse pointer and confuse users.
    (CVE-2019-11754)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
244611	Linux Distros Unpatched Vulnerability : CVE-2019-11754	Nessus	Misc.	Local	medium
129385	Ubuntu 16.04 LTS / 18.04 LTS : Firefox vulnerability (USN-4140-1)	Nessus	Ubuntu Local Security Checks	Local	medium
129101	Mozilla Firefox < 69.0.1	Nessus	Windows	Local	medium
129100	Mozilla Firefox < 69.0.1	Nessus	MacOS X Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-11754

medium

Tenable Plugins

medium

medium

medium

medium