- Arch-security - lists.archlinux.org

[ASA-202001-4] thunderbird: multiple issues
by Morten Linderud 14 Jan '20

14 Jan '20

Arch Linux Security Advisory ASA-202001-4 ========================================= Severity: Critical Date : 2020-01-14 CVE-ID : CVE-2019-17016 CVE-2019-17017 CVE-2019-17022 CVE-2019-17024 CVE-2019-17026 Package : thunderbird Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1086 Summary ======= The package thunderbird before version 68.4.1-1 is vulnerable to multiple issues including arbitrary code execution and insufficient validation. Resolution ========== Upgrade to 68.4.1-1. # pacman -Syu "thunderbird>=68.4.1-1" The problems have been fixed upstream in version 68.4.1. Workaround ========== None. Description =========== - CVE-2019-17016 (insufficient validation) A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. - CVE-2019-17017 (arbitrary code execution) A type confusion issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1, in XPCVariant.cpp where, due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. - CVE-2019-17022 (insufficient validation) A security issue has been found in Firefox before 72.0, and Thunderbird before 68.4.1 where CSS sanitization does not escape HTML tags. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. - CVE-2019-17024 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0, Firefox ESR before 68.4.1, and Thunderbird before 68.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17026 (arbitrary code execution) A type confusion vulnerability has been found in Firefox before 72.0.1, and Thunderbird before 68.4.1. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement. Mozilla is aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker could bypass security measures or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-04/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1603055 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605… https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 https://security.archlinux.org/CVE-2019-17016 https://security.archlinux.org/CVE-2019-17017 https://security.archlinux.org/CVE-2019-17022 https://security.archlinux.org/CVE-2019-17024 https://security.archlinux.org/CVE-2019-17026

1 0

[ASA-202001-3] firefox: arbitrary code execution
by Remi Gacogne 13 Jan '20

13 Jan '20

Arch Linux Security Advisory ASA-202001-3 ========================================= Severity: Critical Date : 2020-01-10 CVE-ID : CVE-2019-17026 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1085 Summary ======= The package firefox before version 72.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 72.0.1-1. # pacman -Syu "firefox>=72.0.1-1" The problem has been fixed upstream in version 72.0.1. Workaround ========== None. Description =========== A type confusion vulnerability has been found in Firefox before 72.0.1. Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion with StoreElementHole and FallibleStoreElement. Mozilla is aware of targeted attacks in the wild abusing this flaw. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1607443 https://security.archlinux.org/CVE-2019-17026

1 0

[ASA-202001-2] file: arbitrary code execution
by Remi Gacogne 13 Jan '20

13 Jan '20

Arch Linux Security Advisory ASA-202001-2 ========================================= Severity: High Date : 2020-01-09 CVE-ID : CVE-2019-18218 Package : file Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1083 Summary ======= The package file before version 5.38-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.38-1. # pacman -Syu "file>=5.38-1" The problem has been fixed upstream in version 5.38. Workaround ========== None. Description =========== cdf_read_property_info in cdf.c in file through 5.37 does not restrict the number of CDF_VECTOR elements, which allows a heap-based buffer overflow (4-byte out-of-bounds write). Impact ====== An attacker is able to execute arbitrary code on the affected host by tricking a user to process a specially crafted file via libmagic or file. References ========== https://bugs.archlinux.org/task/64430 https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=16780 https://security.archlinux.org/CVE-2019-18218

1 0

[ASA-202001-1] firefox: multiple issues
by Remi Gacogne 08 Jan '20

08 Jan '20

Arch Linux Security Advisory ASA-202001-1 ========================================= Severity: Critical Date : 2020-01-08 CVE-ID : CVE-2019-17016 CVE-2019-17017 CVE-2019-17020 CVE-2019-17022 CVE-2019-17023 CVE-2019-17024 CVE-2019-17025 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1084 Summary ======= The package firefox before version 72.0-1 is vulnerable to multiple issues including arbitrary code execution, insufficient validation, access restriction bypass and denial of service. Resolution ========== Upgrade to 72.0-1. # pacman -Syu "firefox>=72.0-1" The problems have been fixed upstream in version 72.0. Workaround ========== None. Description =========== - CVE-2019-17016 (insufficient validation) A security issue has been found in Firefox before 72.0. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. - CVE-2019-17017 (arbitrary code execution) A type confusion issue has been found in Firefox before 72.0, in XPCVariant.cpp where, due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. - CVE-2019-17020 (access restriction bypass) A Content Security Policy bypass has been found in Firefox before 72.0, where the CSP is not applied to XSL stylesheets applied to XML documents. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. - CVE-2019-17022 (insufficient validation) A security issue has been found in Firefox before 72.0, where CSS sanitization does not escape HTML tags. When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the node's innerHTML, assigning it to another innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior, more may exist. - CVE-2019-17023 (denial of service) A security issue has been found in the NSS component of Firefox before 72.0. After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored. - CVE-2019-17024 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0 and Firefox ESR before 68.4. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17025 (arbitrary code execution) Several memory safety issues have been found in Firefox before 72.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker could bypass security measures or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/ https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1599181 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1603055 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1597645 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1602843 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1590001 https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1507180%2C1595470%2C1598605… https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1328295%2C1328300%2C1590447… https://security.archlinux.org/CVE-2019-17016 https://security.archlinux.org/CVE-2019-17017 https://security.archlinux.org/CVE-2019-17020 https://security.archlinux.org/CVE-2019-17022 https://security.archlinux.org/CVE-2019-17023 https://security.archlinux.org/CVE-2019-17024 https://security.archlinux.org/CVE-2019-17025

1 0

[ASA-201912-6] git: arbitrary code execution
by Morten Linderud 18 Dec '19

18 Dec '19

Arch Linux Security Advisory ASA-201912-6 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-1348 CVE-2019-1349 CVE-2019-1352 CVE-2019-1387 CVE-2019-19604 Package : git Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1073 Summary ======= The package git before version 2.24.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 2.24.1-1. # pacman -Syu "git>=2.24.1-1" The problems have been fixed upstream in version 2.24.1. Workaround ========== None. Description =========== - CVE-2019-1348 (arbitrary code execution) A security issue has been found in git before 2.24.1 where the --export-marks option of git fast-import is exposed also via the in- stream command feature export-marks=... and it allows overwriting arbitrary paths. - CVE-2019-1349 (arbitrary code execution) A security issue has been found in git before 2.24.1 when using submodule paths that refer to the same file system entity (e.g. using the NTFS Alternate Data Streams attack mentioned in CVE-2019-1352 where files would be written to the `.git/` directory using a synonymous directory name), it was possible to "squat" on the `git~1` shortname on NTFS drives, opening attacks via `git~2`. This also affects Git when run as a Linux application inside the Windows Subsystem for Linux. - CVE-2019-1352 (arbitrary code execution) A security issue has been found in git before 2.24.1 where it was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone. - CVE-2019-1387 (arbitrary code execution) A security issue has been found in git before 2.24.1 where recursive clones are currently affected by a vulnerability that is caused by too- lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones. - CVE-2019-19604 (arbitrary code execution) A security issue has been found in git before 2.24.1, and it is now disallowed for `.gitmodules` to have entries that set `submodule.<name>.update=!command`. This fixes the vulnerability in Git v2.20.0 and later where a recursive clone followed by a submodule update could execute code contained within the repository without the user explicitly having asked for that. Impact ====== A remote attacker can overwrite files and execute code by abusing NTFS path, submodules and fast-import. References ========== https://github.com/git/git/commit/68061e3470210703cb15594194718d35094afdc0 https://lkml.org/lkml/2019/12/10/905 https://github.com/git/git/commit/0060fd1511b94c918928fa3708f69a3f33895a4a https://github.com/git/git/commit/7c3745fc6185495d5765628b4dfe1bd2c25a2981 https://github.com/git/git/commit/a8dee3ca610f5a1d403634492136c887f83b59d2 https://github.com/git/git/commit/c1547450748fcbac21675f2681506d2d80351a19 https://security.archlinux.org/CVE-2019-1348 https://security.archlinux.org/CVE-2019-1349 https://security.archlinux.org/CVE-2019-1352 https://security.archlinux.org/CVE-2019-1387 https://security.archlinux.org/CVE-2019-19604

1 0

[ASA-201912-5] libgit2: arbitrary code execution
by Morten Linderud 18 Dec '19

18 Dec '19

Arch Linux Security Advisory ASA-201912-5 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-1348 CVE-2019-1349 CVE-2019-1352 CVE-2019-1387 Package : libgit2 Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1075 Summary ======= The package libgit2 before version 1:0.28.4-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1:0.28.4-1. # pacman -Syu "libgit2>=1:0.28.4-1" The problems have been fixed upstream in version 0.28.4. Workaround ========== None. Description =========== - CVE-2019-1348 (arbitrary code execution) A security issue has been found in git before 2.24.1 where the --export-marks option of git fast-import is exposed also via the in- stream command feature export-marks=... and it allows overwriting arbitrary paths. - CVE-2019-1349 (arbitrary code execution) A security issue has been found in git before 2.24.1 when using submodule paths that refer to the same file system entity (e.g. using the NTFS Alternate Data Streams attack mentioned in CVE-2019-1352 where files would be written to the `.git/` directory using a synonymous directory name), it was possible to "squat" on the `git~1` shortname on NTFS drives, opening attacks via `git~2`. This also affects Git when run as a Linux application inside the Windows Subsystem for Linux. - CVE-2019-1352 (arbitrary code execution) A security issue has been found in git before 2.24.1 where it was unaware of NTFS Alternate Data Streams, allowing files inside the .git/ directory to be overwritten during a clone. - CVE-2019-1387 (arbitrary code execution) A security issue has been found in git before 2.24.1 where recursive clones are currently affected by a vulnerability that is caused by too- lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones. Impact ====== A remote attacker can overwrite files and execute code by abusing NTFS path, submodules and fast-import. References ========== https://github.com/git/git/commit/68061e3470210703cb15594194718d35094afdc0 https://lkml.org/lkml/2019/12/10/905 https://github.com/git/git/commit/0060fd1511b94c918928fa3708f69a3f33895a4a https://github.com/git/git/commit/7c3745fc6185495d5765628b4dfe1bd2c25a2981 https://github.com/git/git/commit/a8dee3ca610f5a1d403634492136c887f83b59d2 https://security.archlinux.org/CVE-2019-1348 https://security.archlinux.org/CVE-2019-1349 https://security.archlinux.org/CVE-2019-1352 https://security.archlinux.org/CVE-2019-1387

1 0

[ASA-201912-4] shadow: privilege escalation
by Levente Polyak 18 Dec '19

18 Dec '19

Arch Linux Security Advisory ASA-201912-4 ========================================= Severity: High Date : 2019-12-18 CVE-ID : CVE-2019-19882 Package : shadow Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1079 Summary ======= The package shadow before version 4.8-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8-1. # pacman -Syu "shadow>=4.8-1" The problem has been fixed upstream in version 4.8. Workaround ========== None. Description =========== shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8). Impact ====== A local authenticated user can escalate privileges by using setuid binaries. References ========== https://bugs.archlinux.org/task/64836 https://bugs.gentoo.org/702252 https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac589… https://github.com/shadow-maint/shadow/pull/199 https://github.com/void-linux/void-packages/pull/17580 https://security.archlinux.org/CVE-2019-19882

1 0

[ASA-201912-3] crypto++: private key recovery
by Remi Gacogne 11 Dec '19

11 Dec '19

Arch Linux Security Advisory ASA-201912-3 ========================================= Severity: High Date : 2019-12-06 CVE-ID : CVE-2019-14318 Package : crypto++ Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-1046 Summary ======= The package crypto++ before version 8.2.0-2 is vulnerable to private key recovery. Resolution ========== Upgrade to 8.2.0-2. # pacman -Syu "crypto++>=8.2.0-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A vulnerability has been found in the ECDSA/EdDSA implementation of crypto++ up to 8.2.0, allowing for practical recovery of the long-term private key. Impact ====== An attacker might be able to recover long-term private key by measuring the duration of hundreds to thousands of signing operations of known messages. References ========== https://seclists.org/oss-sec/2019/q4/3 https://minerva.crocs.fi.muni.cz/ https://github.com/weidai11/cryptopp/issues/869 https://github.com/weidai11/cryptopp/pull/870/commits/80c59bcdb251043f27eef… https://github.com/weidai11/cryptopp/commit/c9ef9420e762 https://security.archlinux.org/CVE-2019-14318

1 0

[ASA-201912-2] thunderbird: arbitrary code execution
by Remi Gacogne 11 Dec '19

11 Dec '19

Arch Linux Security Advisory ASA-201912-2 ========================================= Severity: Critical Date : 2019-12-06 CVE-ID : CVE-2019-11745 CVE-2019-17005 CVE-2019-17008 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1072 Summary ======= The package thunderbird before version 68.3.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 68.3.0-1. # pacman -Syu "thunderbird>=68.3.0-1" The problems have been fixed upstream in version 68.3.0. Workaround ========== None. Description =========== - CVE-2019-11745 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the NSS component of Firefox before 71.0 and Thunderbird before 68.3. When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. - CVE-2019-17005 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3 where the plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. - CVE-2019-17008 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. When using nested workers, a use-after- free could occur during worker destruction. This resulted in a potentially exploitable crash. - CVE-2019-17010 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. - CVE-2019-17011 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0 and Thunderbird before 68.3. Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. - CVE-2019-17012 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0 and Thunderbird before 68.3. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-38/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667… https://security.archlinux.org/CVE-2019-11745 https://security.archlinux.org/CVE-2019-17005 https://security.archlinux.org/CVE-2019-17008 https://security.archlinux.org/CVE-2019-17010 https://security.archlinux.org/CVE-2019-17011 https://security.archlinux.org/CVE-2019-17012

1 0

[ASA-201912-1] firefox: multiple issues
by Remi Gacogne 05 Dec '19

05 Dec '19

Arch Linux Security Advisory ASA-201912-1 ========================================= Severity: Critical Date : 2019-12-03 CVE-ID : CVE-2019-11745 CVE-2019-11756 CVE-2019-17005 CVE-2019-17008 CVE-2019-17009 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012 CVE-2019-17013 CVE-2019-17014 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1071 Summary ======= The package firefox before version 71.0-1 is vulnerable to multiple issues including arbitrary code execution, denial of service, information disclosure and privilege escalation. Resolution ========== Upgrade to 71.0-1. # pacman -Syu "firefox>=71.0-1" The problems have been fixed upstream in version 71.0. Workaround ========== None. Description =========== - CVE-2019-11745 (arbitrary code execution) An out-of-bounds write vulnerability has been found in the NSS component of Firefox before 71.0. When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. - CVE-2019-11756 (denial of service) A use-after-free vulnerability has been found in Firefox before 71.0 where improper reference counting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service). - CVE-2019-17005 (arbitrary code execution) An out-of-bounds write vulnerability has been found in Firefox before 71.0 where the plain text serializer used a fixed-size array for the number of elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. - CVE-2019-17008 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. When using nested workers, a use-after-free could occur during worker destruction. This resulted in a potentially exploitable crash. - CVE-2019-17009 (privilege escalation) A privilege escalation vulnerability has been found in Firefox before 71.0. When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. - CVE-2019-17010 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. Under certain conditions, when checking the Resist Fingerprinting preference during device orientation checks, a race condition could have caused a use-after-free and a potentially exploitable crash. - CVE-2019-17011 (arbitrary code execution) A use-after-free vulnerability has been found in Firefox before 71.0. Under certain conditions, when retrieving a document from a DocShell in the antitracking code, a race condition could cause a use-after-free condition and a potentially exploitable crash. - CVE-2019-17012 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17013 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 71.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could have been exploited to run arbitrary code. - CVE-2019-17014 (information disclosure) An information disclosure issue has been found in Firefox before 71.0 where, if an image had not loaded correctly (such as when it is not actually an image), it could be dragged and dropped cross-domain, resulting in a cross-origin information leak. Impact ====== A remote attacker can crash Firefox, access sensitive information, escalate privileges and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1586176 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-117… https://bugzilla.mozilla.org/show_bug.cgi?id=1508776 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1584170 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1546331 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1510494 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1581084 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1591334 https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667… https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439… https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-170… https://bugzilla.mozilla.org/show_bug.cgi?id=1322864 https://security.archlinux.org/CVE-2019-11745 https://security.archlinux.org/CVE-2019-11756 https://security.archlinux.org/CVE-2019-17005 https://security.archlinux.org/CVE-2019-17008 https://security.archlinux.org/CVE-2019-17009 https://security.archlinux.org/CVE-2019-17010 https://security.archlinux.org/CVE-2019-17011 https://security.archlinux.org/CVE-2019-17012 https://security.archlinux.org/CVE-2019-17013 https://security.archlinux.org/CVE-2019-17014

1 0