8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.014 Low
EPSS
Percentile
86.3%
Severity: Critical
Date : 2019-12-03
CVE-ID : CVE-2019-11745 CVE-2019-11756 CVE-2019-17005 CVE-2019-17008
CVE-2019-17009 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012
CVE-2019-17013 CVE-2019-17014
Package : firefox
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-1071
The package firefox before version 71.0-1 is vulnerable to multiple
issues including arbitrary code execution, denial of service,
information disclosure and privilege escalation.
Upgrade to 71.0-1.
The problems have been fixed upstream in version 71.0.
None.
An out-of-bounds write vulnerability has been found in the NSS
component of Firefox before 71.0. When encrypting with a block cipher,
if a call to NSC_EncryptUpdate was made with data smaller than the
block size, a small out of bounds write could occur. This could have
caused heap corruption and a potentially exploitable crash.
A use-after-free vulnerability has been found in Firefox before 71.0
where improper reference counting of soft token session objects could
cause a use-after-free and crash (likely limited to a denial of
service).
An out-of-bounds write vulnerability has been found in Firefox before
71.0 where the plain text serializer used a fixed-size array for the
number of elements it could process; however it was possible to
overflow the static-sized array leading to memory corruption and a
potentially exploitable crash.
A use-after-free vulnerability has been found in Firefox before 71.0.
When using nested workers, a use-after-free could occur during worker
destruction. This resulted in a potentially exploitable crash.
A privilege escalation vulnerability has been found in Firefox before
71.0. When running, the updater service wrote status and log files to
an unrestricted location; potentially allowing an unprivileged process
to locate and exploit a vulnerability in file handling in the updater
service.
A use-after-free vulnerability has been found in Firefox before 71.0.
Under certain conditions, when checking the Resist Fingerprinting
preference during device orientation checks, a race condition could
have caused a use-after-free and a potentially exploitable crash.
A use-after-free vulnerability has been found in Firefox before 71.0.
Under certain conditions, when retrieving a document from a DocShell in
the antitracking code, a race condition could cause a use-after-free
condition and a potentially exploitable crash.
Several memory safety bugs have been found in Firefox before 71.0. Some
of these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.
Several memory safety bugs have been found in Firefox before 71.0. Some
of these bugs showed evidence of memory corruption and Mozilla presumes
that with enough effort some of these could have been exploited to run
arbitrary code.
An information disclosure issue has been found in Firefox before 71.0
where, if an image had not loaded correctly (such as when it is not
actually an image), it could be dragged and dropped cross-domain,
resulting in a cross-origin information leak.
A remote attacker can crash Firefox, access sensitive information,
escalate privileges and execute arbitrary code on the affected host.
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11745
https://bugzilla.mozilla.org/show_bug.cgi?id=1586176
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756
https://bugzilla.mozilla.org/show_bug.cgi?id=1508776
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17005
https://bugzilla.mozilla.org/show_bug.cgi?id=1584170
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17008
https://bugzilla.mozilla.org/show_bug.cgi?id=1546331
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17009
https://bugzilla.mozilla.org/show_bug.cgi?id=1510494
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17010
https://bugzilla.mozilla.org/show_bug.cgi?id=1581084
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17011
https://bugzilla.mozilla.org/show_bug.cgi?id=1591334
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17012
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667%2C1567209%2C1580288%2C1585760%2C1592502
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17013
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181
https://www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17014
https://bugzilla.mozilla.org/show_bug.cgi?id=1322864
https://security.archlinux.org/CVE-2019-11745
https://security.archlinux.org/CVE-2019-11756
https://security.archlinux.org/CVE-2019-17005
https://security.archlinux.org/CVE-2019-17008
https://security.archlinux.org/CVE-2019-17009
https://security.archlinux.org/CVE-2019-17010
https://security.archlinux.org/CVE-2019-17011
https://security.archlinux.org/CVE-2019-17012
https://security.archlinux.org/CVE-2019-17013
https://security.archlinux.org/CVE-2019-17014
bugzilla.mozilla.org/buglist.cgi?bug_id=1298509%2C1472328%2C1577439%2C1577937%2C1580320%2C1584195%2C1585106%2C1586293%2C1593865%2C1594181
bugzilla.mozilla.org/buglist.cgi?bug_id=1449736%2C1533957%2C1560667%2C1567209%2C1580288%2C1585760%2C1592502
bugzilla.mozilla.org/show_bug.cgi?id=1322864
bugzilla.mozilla.org/show_bug.cgi?id=1508776
bugzilla.mozilla.org/show_bug.cgi?id=1510494
bugzilla.mozilla.org/show_bug.cgi?id=1546331
bugzilla.mozilla.org/show_bug.cgi?id=1581084
bugzilla.mozilla.org/show_bug.cgi?id=1584170
bugzilla.mozilla.org/show_bug.cgi?id=1586176
bugzilla.mozilla.org/show_bug.cgi?id=1591334
security.archlinux.org/AVG-1071
security.archlinux.org/CVE-2019-11745
security.archlinux.org/CVE-2019-11756
security.archlinux.org/CVE-2019-17005
security.archlinux.org/CVE-2019-17008
security.archlinux.org/CVE-2019-17009
security.archlinux.org/CVE-2019-17010
security.archlinux.org/CVE-2019-17011
security.archlinux.org/CVE-2019-17012
security.archlinux.org/CVE-2019-17013
security.archlinux.org/CVE-2019-17014
www.mozilla.org/en-US/security/advisories/mfsa2019-36/
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11745
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-11756
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17005
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17008
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17009
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17010
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17011
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17012
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17013
www.mozilla.org/en-US/security/advisories/mfsa2019-36/#CVE-2019-17014
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.014 Low
EPSS
Percentile
86.3%