Summary
A sandbox escape was discovered in Firefox. If a user were tricked in to
installing a malicious language pack, an attacker could exploit this to
gain additional privileges. (CVE-2019-9811)
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information, bypass same origin restrictions, conduct cross-site scripting
(XSS) attacks, conduct cross-site request forgery (CSRF) attacks, spoof
origin attributes, spoof the addressbar contents, bypass safebrowsing
protections, or execute arbitrary code. (CVE-2019-11709, CVE-2019-11710,
CVE-2019-11711, CVE-2019-11712, CVE-2019-11713, CVE-2019-11714,
CVE-2019-11715, CVE-2019-11716, CVE-2019-11717, CVE-2019-11718,
CVE-2019-11719, CVE-2019-11720, CVE-2019-11721, CVE-2019-11723,
CVE-2019-11724, CVE-2019-11725, CVE-2019-11727, CVE-2019-11728,
CVE-2019-11729)
It was discovered that Firefox treats all files in a directory as same
origin. If a user were tricked in to downloading a specially crafted HTML
file, an attacker could potentially exploit this to obtain sensitive
information from local files. (CVE-2019-11730)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 68.0+build3-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 68.0+build3-0ubuntu0.18.04.1 |
Vulnerabilities 21
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some o…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 67. Some of these bugs showed e…
-
Unscored —
When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages …
-
Unscored —
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS require…
-
Unscored —
A use-after-free vulnerability can occur in HTTP/2 when a cached HTTP/2 stream is closed while still in use, resulting …
-
Unscored —
Necko can access a child on the wrong thread during UDP connections, resulting in a potentially exploitable crash in so…
-
Unscored —
Due to an error while parsing page content, it is possible for properly sanitized user input to be misinterpreted and l…
-
Unscored —
Until explicitly accessed by script, window.globalThis is not enumerable and, as a result, is not visible to code such …
-
Unscored —
A vulnerability exists where the caret ("^") character is improperly escaped constructing some URIs due to it being use…
-
Unscored —
Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on…
-
Unscored —
When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bo…
-
Unscored —
Some unicode characters are incorrectly treated as whitespace during the parsing of web content instead of triggering p…
-
Unscored —
The unicode latin 'kra' character can be used to spoof a standard 'k' character in the addressbar. This allows for doma…
-
Unscored —
A vulnerability exists during the installation of add-ons where the initial fetch ignored the origin attributes of the …
-
Unscored —
Application permissions give additional remote troubleshooting permission to the site input.mozilla.org, which has been…
-
Unscored —
When a user navigates to site marked as unsafe by the Safebrowsing API, warning messages are displayed and navigation i…
-
Unscored —
A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1…
-
Unscored —
The HTTP Alternative Services header, Alt-Svc, can be used by a malicious site to scan all TCP ports of any host that t…
-
Unscored —
Empty or malformed p256-ECDH public keys may trigger a segmentation fault due values being improperly sanitized before …
-
Unscored —
A vulnerability exists where if a user opens a locally saved HTML file, this file can use file: URIs to access other fi…
-
Unscored —
As part of a winning Pwn2Own entry, a researcher demonstrated a sandbox escape by installing a malicious language pack …
References
-
report
https://ubuntu.com/security/CVE-2019-9811
-
report
https://ubuntu.com/security/CVE-2019-11709
-
report
https://ubuntu.com/security/CVE-2019-11710
-
report
https://ubuntu.com/security/CVE-2019-11711
-
report
https://ubuntu.com/security/CVE-2019-11712
-
report
https://ubuntu.com/security/CVE-2019-11713
-
report
https://ubuntu.com/security/CVE-2019-11714
-
report
https://ubuntu.com/security/CVE-2019-11715
-
report
https://ubuntu.com/security/CVE-2019-11716
-
report
https://ubuntu.com/security/CVE-2019-11717
-
report
https://ubuntu.com/security/CVE-2019-11718
-
report
https://ubuntu.com/security/CVE-2019-11719
-
report
https://ubuntu.com/security/CVE-2019-11720
-
report
https://ubuntu.com/security/CVE-2019-11721
-
report
https://ubuntu.com/security/CVE-2019-11723
-
report
https://ubuntu.com/security/CVE-2019-11724
-
report
https://ubuntu.com/security/CVE-2019-11725
-
report
https://ubuntu.com/security/CVE-2019-11727
-
report
https://ubuntu.com/security/CVE-2019-11728
-
report
https://ubuntu.com/security/CVE-2019-11729
-
report
https://ubuntu.com/security/CVE-2019-11730