SB2019102704 - Arch Linux update for firefox
Published: October 27, 2019 Updated: January 17, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 secuirty vulnerabilities.
1) Heap-based buffer overflow (CVE-ID: CVE-2018-6156)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to heap-based buffer overflow in WebRTC when handling malicious input. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
2) Use-after-free (CVE-ID: CVE-2019-11757)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when storing a value in IndexedDB. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
3) Stack-based buffer overflow (CVE-ID: CVE-2019-11759)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing HMAC data. A remote attacker can create a specially crafted web page that causes 4 bytes of HMAC output to be written past the end of a buffer stored on the stack, trick the victim into visiting it and crash the application.
4) Stack-based buffer overflow (CVE-ID: CVE-2019-11760)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in nrappkit when doing WebRTC signaling. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-11761)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the application allows access to a privileged JSONView object that had been cloned into content. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information.
6) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-11762)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the way Firefox processes two same-origin documents that set document.domain differently to become cross-origin. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to potentially sensitive information, as it is possible to call arbitrary DOM methods/getters/setters on the now-cross-origin window.
7) Protection mechanism failure (CVE-ID: CVE-2019-11763)
The vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability exists due to the way Firefox processes HTML entities. A remote attacker can create a specially crafted web page and make the browser treat HTML comment text as HTML, which could have led to XSS in a web application.
8) Buffer overflow (CVE-ID: CVE-2019-11764)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
9) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-11765)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to the way Firefox handles messages to the parent process that trigger the 'Click to Play' permission prompt to be shown. A remote attacker can create a specially crafted web page and assign arbitrary permissions instead of 'Click to Play' permission, if the user accepted the permission request.
10) Out-of-bounds read (CVE-ID: CVE-2019-15903)
The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing XML documents within the expat library. A remote attacker can create a specially crafted XML file, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the affected application.
11) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-17000)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to the object tag with a data URI does not correctly inherit the document's Content Security Policy. A remote attacker can use a specually crafted website to bypass a cross-origin frame if the document's policy explicitly allowed data: URIs.
12) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-17001)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to the Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in the protected document. A remote attacker can use such behavior in conjunction with XSS vulnerability on the website to bypass CSP protection using object tag when script-src 'none' is specified.
13) Cleartext transmission of sensitive information (CVE-ID: CVE-2019-17002)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to software processes upgrade-insecure-requests in the Content Security Policy, and a link is dragged and dropped from such page. As a result, the link is not upgraded to https and allows to transmit data over unencrypted channel.
Remediation
Install update from vendor's website.