Ubuntu update for Firefox

1) Buffer overflow

EUVDB-ID: #VU18048

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9788

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to multiple boundary errors when processing HTML content. A remote attacker trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU18049

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9789

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to multiple boundary errors when processing HTML content. A remote attacker trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU18029

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9790

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. A remote attacker can trick the victim to visit a specially crafted web page, trigger use-after-free error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Type confusion

EUVDB-ID: #VU18030

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-9791

CWE-ID: CWE-843 - Type confusion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a type confusion error within the type inference system. The system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is entered through on-stack replacement (OSR). A remote attacker can trick the victim to visit a specially crafted web page, trigger type confusion error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Memory corruption

EUVDB-ID: #VU18031

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-9792

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the IonMonkey just-in-time (JIT) compiler that leaks an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

6) Type confusion

EUVDB-ID: #VU18034

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9795

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a type confusion error within the IonMonkey just-in-time (JIT) compiler. A remote attacker can trick the victim to visit a specially crafted web page, trigger type confusion error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

EUVDB-ID: #VU18035

Risk: High

CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9796

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the SMIL animation controller. A remote attacker can trick the victim to visit a specially crafted web page, trigger use-after-free error and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18036

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9797

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to incorrect implementation of the cross-origin policy when reading images using createImageBitmap. A remote attacker can trick the victim into visiting a specially crafted web page and gain access to images opened in other browser tabs.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU18038

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9799

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when reading IPC messages. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds read error and read memory from the parent process under certain conditions.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18040

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9802

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to improper handling of FTP downloads. A remote attacker can trick the victim to open a specially crafted web page and initiate an FTP download which will then use a child process to render the downloaded data. The downloaded data can then be passed to the Chrome process with an arbitrary file length supplied by an attacker, bypassing sandbox protections and allow for a potential memory read of adjacent data from the privileged Chrome process.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds read

EUVDB-ID: #VU18043

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9805

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to perform a denial of service attack.

The vulnerability exists due to a boundary condition within the Prio library . A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger out-of-bounds read error and crash the application.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource management error

EUVDB-ID: #VU18044

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9806

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to browser does not limit the number of authorization prompts for FTP transactions, displaying unlimited number of modal prompts that cannot be dismissed. A remote attacker can trick the victim to connect to a malicious crafted FTP server and perform denial of service attack against the browser.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Resource management error

EUVDB-ID: #VU18045

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9807

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a phishing attack.

The vulnerability exists due to the way text messages produced by the FTP server are handled by the browser when a page reload is initiated. A remote attacker can create a modal alert message with arbitrary text as content and perform phishing attack.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Resource management error

EUVDB-ID: #VU18047

Risk: Low

CVSSv3.1: 3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9808

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a phishing attack.

The vulnerability exists due to incorrect handling of WebRTC permissions requests for documents with data: or blob: URLs, resulting in "Unknown origin"  notification. A remote attacker can abuse this behavior and trick the victim into granting permissions to a malicious website.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Resource management error

EUVDB-ID: #VU18046

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9809

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect processing of modal alert messages sent by FTP server. A remote attacker can trick the victim to connect to a malicious FTP server and trigger a series of modal alert messages for these resources through invalid credentials or locations, resulting in denial of service attack

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Memory corruption

EUVDB-ID: #VU18032

Risk: High

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9793

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to missing boundary checks for strings, arrays or typed arrays when the default Spectre mitigations have been disabled. A remote attacker can trick the victim to visit a specially crafted web page, trigger memory corruption and execute arbitrary code on the system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system but requires the user to specifically disable Spectre mitigations.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18041

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9803

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform man-in-the-middle attack.

The vulnerability exists due to incorrect enforcement of Upgrade-Insecure-Requests (UIR) for same-origin navigation allowing the browser to navigate to HTTP URL instead of HTTPS. A remote attacker can perform man-in-the-middle (MitM) attack and gain access to sensitive information.

Mitigation

Update the affected packages.

Ubuntu 14.04 LTS

firefox - 66.0.1+build1-0ubuntu0.14.04.1

Vulnerable software versions

firefox (Ubuntu package): 60.0+build2-0ubuntu0.14.04.1 - 65.0.1+build2-0ubuntu0.14.04.1

External links

http://usn.ubuntu.com/3918-2/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.