Input validation error in firefox-esr (Alpine package)

1) Input validation error

EUVDB-ID: #VU33032

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-11711

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

When an inner window is reused, it does not consider the use of document.domain for cross-origin protections. If pages on different subdomains ever cooperatively use document.domain, then either page can abuse this to inject script into arbitrary pages on the other subdomain, even those that did not use document.domain to relax their origin security. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Mitigation

Install update from vendor's website.

Vulnerable software versions

firefox-esr (Alpine package): 60.4.0-r0 - 68.0-r0

CPE2.3

• cpe:2.3:a:alpine:firefox-esr_alpine_package:60.4.0-r0:*:*:*:*:alpine_linux:*:3.8
• cpe:2.3:a:alpine:firefox-esr_alpine_package:60.4.0-r1:*:*:*:*:alpine_linux:*:3.8
• cpe:2.3:a:alpine:firefox-esr_alpine_package:60.5.0-r0:*:*:*:*:alpine_linux:*:3.9

External links

https://git.alpinelinux.org/aports/commit/?id=2158f01e86aa6551e5e429999acda15151214929
https://git.alpinelinux.org/aports/commit/?id=dbc43022e7aaaeb53d19f31c2ba03ab99f95c608
https://git.alpinelinux.org/aports/commit/?id=2619d83127353533f980218076d6c0c02fe7c198
https://git.alpinelinux.org/aports/commit/?id=a0c09e8b7fb341082bdaced72c40714ba91f932a

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.