Lucene search

K
altlinuxHttps://packages.altlinux.org/en/sisyphus/security/8E7F15E139CBB26592197E8D5DAD8454
HistorySep 04, 2019 - 12:00 a.m.

Security fix for the ALT Linux 10 package firefox-esr version 68.1.0-alt1

2019-09-0400:00:00
https://packages.altlinux.org/en/sisyphus/security/
packages.altlinux.org
5

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.008 Low

EPSS

Percentile

79.8%

Sept. 4, 2019 Andrey Cherepanov 68.1.0-alt1

- New ESR version (68.1.0).
- Fixed:
  + CVE-2019-11751 Malicious code execution through command line parameters
  + CVE-2019-11746 Use-after-free while manipulating video
  + CVE-2019-11744 XSS by breaking out of title and textarea elements using innerHTML
  + CVE-2019-11742 Same-origin policy violation with SVG filters and canvas to steal cross-origin images
  + CVE-2019-11736 File manipulation and privilege escalation in Mozilla Maintenance Service
  + CVE-2019-11753 Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location
  + CVE-2019-11752 Use-after-free while extracting a key value in IndexedDB
  + CVE-2019-9812 Sandbox escape through Firefox Sync
  + CVE-2019-11743 Cross-origin access to unload event attributes
  + CVE-2019-11748 Persistence of WebRTC permissions in a third party context
  + CVE-2019-11749 Camera information available without prompting using getUserMedia
  + CVE-2019-11750 Type confusion in Spidermonkey
  + CVE-2019-11738 Content security policy bypass through hash-based sources in directives
  + CVE-2019-11747 'Forget about this site' removes sites from pre-loaded HSTS list
  + CVE-2019-11735 Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1
  + CVE-2019-11740 Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9
- Build in 8 jobs.

9.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.008 Low

EPSS

Percentile

79.8%