[ASA-201912-1] firefox: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201912-1
=========================================

Severity: Critical
Date    : 2019-12-03
CVE-ID  : CVE-2019-11745 CVE-2019-11756 CVE-2019-17005 CVE-2019-17008
          CVE-2019-17009 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012
          CVE-2019-17013 CVE-2019-17014
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1071

Summary
=======

The package firefox before version 71.0-1 is vulnerable to multiple
issues including arbitrary code execution, denial of service,
information disclosure and privilege escalation.

Resolution
==========

Upgrade to 71.0-1.

# pacman -Syu "firefox>=71.0-1"

The problems have been fixed upstream in version 71.0.

Workaround
==========

None.

Description
===========

- CVE-2019-11745 (arbitrary code execution)

An out-of-bounds write vulnerability has been found in the NSS
component of Firefox before 71.0. When encrypting with a block cipher,
if a call to NSC_EncryptUpdate was made with data smaller than the
block size, a small out of bounds write could occur. This could have
caused heap corruption and a potentially exploitable crash.

- CVE-2019-11756 (denial of service)

A use-after-free vulnerability has been found in Firefox before 71.0
where improper reference counting of soft token session objects could
cause a use-after-free and crash (likely limited to a denial of
service).

- CVE-2019-17005 (arbitrary code execution)

An out-of-bounds write vulnerability has been found in Firefox before
71.0 where the plain text serializer used a fixed-size array for the
number of elements it could process; however it was possible to
overflow the static-sized array leading to memory corruption and a
potentially exploitable crash.

- CVE-2019-17008 (arbitrary code execution)

A use-after-free vulnerability has been found in Firefox before 71.0.
When using nested workers, a use-after-free could occur during worker
destruction. This resulted in a potentially exploitable crash.

- CVE-2019-17009 (privilege escalation)

A privilege escalation vulnerability has been found in Firefox before
71.0. When running, the updater service wrote status and log files to
an unrestricted location; potentially allowing an unprivileged process
to locate and exploit a vulnerability in file handling in the updater
service.

- CVE-2019-17010 (arbitrary code execution)

A use-after-free vulnerability has been found in Firefox before 71.0.
Under certain conditions, when checking the Resist Fingerprinting
preference during device orientation checks, a race condition could
have caused a use-after-free and a potentially exploitable crash.

- CVE-2019-17011 (arbitrary code execution)

A use-after-free vulnerability has been found in Firefox before 71.0.
Under certain conditions, when retrieving a document from a DocShell in
the antitracking code, a race condition could cause a use-after-free
condition and a potentially exploitable crash.

- CVE-2019-17012 (arbitrary code execution)

Several memory safety bugs have been found in Firefox before 71.0. Some
of these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.

- CVE-2019-17013 (arbitrary code execution)

Several memory safety bugs have been found in Firefox before 71.0. Some
of these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.

- CVE-2019-17014 (information disclosure)

An information disclosure issue has been found in Firefox before 71.0
where, if an image had not loaded correctly (such as when it is not
actually an image), it could be dragged and dropped cross-domain,
resulting in a cross-origin information leak.

Impact
======

A remote attacker can crash Firefox, access sensitive information,
escalate privileges and execute arbitrary code on the affected host.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11745
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756
https://bugzilla.mozilla.org/show_bug.cgi?id=1508776
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17005
https://bugzilla.mozilla.org/show_bug.cgi?id=1584170
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17008
https://bugzilla.mozilla.org/show_bug.cgi?id=1546331
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17009
https://bugzilla.mozilla.org/show_bug.cgi?id=1510494
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17010
https://bugzilla.mozilla.org/show_bug.cgi?id=1581084
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17011
https://bugzilla.mozilla.org/show_bug.cgi?id=1591334
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17012
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667%2C1567209%2C1580288%2C1585760%2C1592502
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17013
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17014
https://bugzilla.mozilla.org/show_bug.cgi?id=1322864
https://security.archlinux.org/CVE-2019-11745
https://security.archlinux.org/CVE-2019-11756
https://security.archlinux.org/CVE-2019-17005
https://security.archlinux.org/CVE-2019-17008
https://security.archlinux.org/CVE-2019-17009
https://security.archlinux.org/CVE-2019-17010
https://security.archlinux.org/CVE-2019-17011
https://security.archlinux.org/CVE-2019-17012
https://security.archlinux.org/CVE-2019-17013
https://security.archlinux.org/CVE-2019-17014

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20191205/6e6162aa/attachment.sig>