Summary
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, bypass security
restrictions, bypass same-origin restrictions, conduct cross-site
scripting (XSS) attacks, bypass content security policy (CSP) protections,
or execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | firefox | 70.0+build2-0ubuntu0.16.04.1 |
| Ubuntu · 18.04 LTS 18.04:LTS | firefox | 70.0+build2-0ubuntu0.18.04.1 |
Vulnerabilities 13
-
Medium 6.5
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing to…
-
Unscored —
Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to po…
-
Unscored —
When following the value's prototype chain, it was possible to retain a reference to a locale, delete it, and subsequen…
-
Unscored —
An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This c…
-
Unscored —
A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. This resulted in a potentially exploi…
-
Unscored —
By using a form with a data URI it was possible to gain access to the privileged JSONView object that had been cloned i…
-
Unscored —
If two same-origin documents set document.domain differently to become cross-origin, it was possible for them to call a…
-
Unscored —
Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these enti…
-
Unscored —
Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox ESR 68.1. Some o…
-
Unscored —
A compromised content process could send a message to the parent process that would cause the 'Click to Play' permissio…
-
Unscored —
An object tag with a data URI did not correctly inherit the document's Content Security Policy. This allowed a CSP bypa…
-
Unscored —
A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in th…
-
Unscored —
If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and dropped from that…
References
-
report
https://ubuntu.com/security/CVE-2018-6156
-
report
https://ubuntu.com/security/CVE-2019-11757
-
report
https://ubuntu.com/security/CVE-2019-11759
-
report
https://ubuntu.com/security/CVE-2019-11760
-
report
https://ubuntu.com/security/CVE-2019-11761
-
report
https://ubuntu.com/security/CVE-2019-11762
-
report
https://ubuntu.com/security/CVE-2019-11763
-
report
https://ubuntu.com/security/CVE-2019-11764
-
report
https://ubuntu.com/security/CVE-2019-11765
-
report
https://ubuntu.com/security/CVE-2019-15903
-
report
https://ubuntu.com/security/CVE-2019-17000
-
report
https://ubuntu.com/security/CVE-2019-17001
-
report
https://ubuntu.com/security/CVE-2019-17002