SB2019032308 - Memory corruption in firefox-esr (Alpine package)

Description

This security bulletin contains information about 1 vulnerability.

1) Memory corruption (CVE-ID: CVE-2019-9794)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to improper validation of command line arguments within the URI handler when opening documents with Firefox. A remote attacker can trick the victim to open a file with a specially crafted filename and execute arbitrary commands on the system.

Note, this vulnerability can be exploited against Firefox installations on Windows operating system only.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=5f4478599688e562154c7fc319b29c46f79083bf
• https://git.alpinelinux.org/aports/commit/?id=985780d336a595bbba269e8d1c32715d70dbee68