Arch Linux Security Advisory ASA-201905-9 ========================================= Severity: Critical Date : 2019-05-23 CVE-ID : CVE-2019-7317 CVE-2019-9800 CVE-2019-9814 CVE-2019-9816 CVE-2019-9817 CVE-2019-9819 CVE-2019-9820 CVE-2019-9821 CVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11695 CVE-2019-11696 CVE-2019-11697 CVE-2019-11698 CVE-2019-11699 CVE-2019-11701 Package : firefox Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-966 Summary ======= The package firefox before version 67.0-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, same-origin policy bypass, content spoofing, information disclosure, cross-site scripting and denial of service. Resolution ========== Upgrade to 67.0-1. # pacman -Syu "firefox>=67.0-1" The problems have been fixed upstream in version 67.0. Workaround ========== None. Description =========== - CVE-2019-7317 (denial of service) png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute. - CVE-2019-9800 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 67.0 and Thunderbird before 60.7.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2019-9814 (arbitrary code execution) Several memory safety bugs have been found in Firefox before 67.0. Some of these bugs showed evidence of memory corruption and Mozilla presumes that with enough effort some of these could be exploited to run arbitrary code. - CVE-2019-9816 (access restriction bypass) A possible vulnerability exists in Firefox before 67.0 and Thunderbird before 60.7.0, where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note that this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases. - CVE-2019-9817 (same-origin policy bypass) In Firefox before 67.0 and Thunderbird before 60.7.0, images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. - CVE-2019-9819 (arbitrary code execution) A vulnerability where a JavaScript compartment mismatch can occur in Firefox before 67.0 and Thunderbird before 60.7.0, while working with the fetch API, resulting in a potentially exploitable crash. - CVE-2019-9820 (arbitrary code execution) A use-after-free vulnerability can occur in the chrome event handler of Firefox before 67.0 when it is freed while still in use. This results in a potentially exploitable crash. - CVE-2019-9821 (arbitrary code execution) A use-after-free vulnerability can occur in AssertWorkerThread in Firefox before 67.0, due to a race condition with shared workers. This results in a potentially exploitable crash. - CVE-2019-11691 (arbitrary code execution) A use-after-free vulnerability can occur in Firefox before 67.0 and Thunderbird before 60.7.0, when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. - CVE-2019-11692 (arbitrary code execution) A use-after-free vulnerability can occur in Firefox before 67.0 and Thunderbird before 60.7.0, when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. - CVE-2019-11693 (arbitrary code execution) The bufferdata function in WebGL in Firefox before 67.0 and Thunderbird before 60.7.0 is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. - CVE-2019-11695 (content spoofing) In Firefox before 67.0, a custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. - CVE-2019-11696 (content spoofing) In Firefox before 67.0, files with the .JNLP extension used for "Java web start" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. - CVE-2019-11697 (access restriction bypass) In Firefox before 67.0, if the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. - CVE-2019-11698 (information disclosure) If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar in Firefox before 67.0 or Thunderbird before 60.7.0, and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. - CVE-2019-11699 (content spoofing) A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations in Firefox before 67.0. This could result in user confusion of which site is currently loaded for spoofing attacks. - CVE-2019-11701 (cross-site scripting) The default webcal: protocol handler in Firefox before 67.0 will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. Impact ====== A remote attacker can crash the browser, access sensitive information, bypass security measures or execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/ https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803 https://github.com/glennrp/libpng/issues/275 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9800 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1540166%2C1534593%2C1546327%... https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9814 https://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%... https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9816 https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-9816 https://bugzilla.mozilla.org/show_bug.cgi?id=1536768 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9817 https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-9817 https://bugzilla.mozilla.org/show_bug.cgi?id=1540221 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9819 https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-9819 https://bugzilla.mozilla.org/show_bug.cgi?id=1532553 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9820 https://bugzilla.mozilla.org/show_bug.cgi?id=1536405 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9821 https://bugzilla.mozilla.org/show_bug.cgi?id=1539125 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1542465 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1544670 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1532525 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1445844 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1392955 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1440079 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1543191 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1169... https://bugzilla.mozilla.org/show_bug.cgi?id=1528939 https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-1170... https://bugzilla.mozilla.org/show_bug.cgi?id=1518627 https://security.archlinux.org/CVE-2019-7317 https://security.archlinux.org/CVE-2019-9800 https://security.archlinux.org/CVE-2019-9814 https://security.archlinux.org/CVE-2019-9816 https://security.archlinux.org/CVE-2019-9817 https://security.archlinux.org/CVE-2019-9819 https://security.archlinux.org/CVE-2019-9820 https://security.archlinux.org/CVE-2019-9821 https://security.archlinux.org/CVE-2019-11691 https://security.archlinux.org/CVE-2019-11692 https://security.archlinux.org/CVE-2019-11693 https://security.archlinux.org/CVE-2019-11695 https://security.archlinux.org/CVE-2019-11696 https://security.archlinux.org/CVE-2019-11697 https://security.archlinux.org/CVE-2019-11698 https://security.archlinux.org/CVE-2019-11699 https://security.archlinux.org/CVE-2019-11701