If the ALT and "a" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.
{"ubuntucve": [{"lastseen": "2022-10-26T14:03:27", "description": "If the ALT and \"a\" keys are pressed when users receive an extension\ninstallation prompt, the extension will be installed without the install\nprompt delay that keeps the prompt visible in order for users to accept or\ndecline the installation. A malicious web page could use this with spoofing\non the page to trick users into installing a malicious extension. This\nvulnerability affects Firefox < 67.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[tyhicks](<https://launchpad.net/~tyhicks>) | mozjs contains a copy of the SpiderMonkey JavaScript engine\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-05-21T00:00:00", "type": "ubuntucve", "title": "CVE-2019-11697", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11697"], "modified": "2019-05-21T00:00:00", "id": "UB:CVE-2019-11697", "href": "https://ubuntu.com/security/CVE-2019-11697", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "veracode": [{"lastseen": "2022-07-26T16:50:41", "description": "firefox performs unauthorized installation. If the ALT and \"a\" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2020-09-21T06:29:51", "type": "veracode", "title": "Unauthorized Installation", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11697"], "modified": "2022-04-19T18:39:15", "id": "VERACODE:27001", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-27001/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "debiancve": [{"lastseen": "2023-03-21T06:06:47", "description": "If the ALT and \"a\" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. This vulnerability affects Firefox < 67.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 6.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-07-23T14:15:00", "type": "debiancve", "title": "CVE-2019-11697", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11697"], "modified": "2019-07-23T14:15:00", "id": "DEBIANCVE:CVE-2019-11697", "href": "https://security-tracker.debian.org/tracker/CVE-2019-11697", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "openvas": [{"lastseen": "2019-08-01T13:51:07", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-06-15T00:00:00", "type": "openvas", "title": "Ubuntu Update for firefox USN-3991-3", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11692", "CVE-2019-11696", "CVE-2019-7317", "CVE-2019-9817", "CVE-2019-11699", "CVE-2019-11693", "CVE-2019-9814", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-9819", "CVE-2019-9800", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11701", "CVE-2019-9816", "CVE-2019-11691", "CVE-2019-11695"], "modified": "2019-08-01T00:00:00", "id": "OPENVAS:1361412562310844052", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844052", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844052\");\n script_version(\"2019-08-01T07:22:04+0000\");\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9817\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-9816\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-08-01 07:22:04 +0000 (Thu, 01 Aug 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-06-15 02:00:31 +0000 (Sat, 15 Jun 2019)\");\n script_name(\"Ubuntu Update for firefox USN-3991-3\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.10|UBUNTU19\\.04|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"3991-3\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-June/004959.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'firefox'\n package(s) announced via the USN-3991-3 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a\nsubsequent regression. The update caused an additional regression that\nresulted in Firefox failing to load correctly after executing it in safe\nmode. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n\u00a0Multiple security issues were discovered in Firefox. If a user were\n\u00a0tricked in to opening a specially crafted website, an attacker could\n\u00a0potentially exploit these to cause a denial of service, spoof the browser\n\u00a0UI, trick the user in to launching local executable binaries, obtain\n\u00a0sensitive information, conduct cross-site scripting (XSS) attacks, or\n\u00a0execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,\n\u00a0CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701,\n\u00a0CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819,\n\u00a0CVE-2019-9820, CVE-2019-9821)\n\u00a0\n\u00a0It was discovered that pressing certain key combinations could bypass\n\u00a0addon installation prompt delays. If a user opened a specially crafted\n\u00a0website, an attacker could potentially exploit this to trick them in to\n\u00a0installing a malicious extension. (CVE-2019-11697)\n\u00a0\n\u00a0It was discovered that history data could be exposed via drag and drop\n\u00a0of hyperlinks to and from bookmarks. If a user were tricked in to dragging\n\u00a0a specially crafted hyperlink to the bookmark toolbar or sidebar, and\n\u00a0subsequently back in to the web content area, an attacker could\n\u00a0potentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\u00a0\n\u00a0A type confusion bug was discovered with object groups and UnboxedObjects.\n\u00a0If a user were tricked in to opening a specially crafted website after\n\u00a0enabling the UnboxedObjects feature, an attacker could potentially\n\u00a0exploit this to bypass security checks. (CVE-2019-9816)\");\n\n script_tag(name:\"affected\", value:\"'firefox' package(s) on Ubuntu 19.04, Ubuntu 18.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.2+build2-0ubuntu0.18.10.1\", rls:\"UBUNTU18.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.2+build2-0ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.2+build2-0ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.2+build2-0ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-08-01T13:51:30", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-05-22T00:00:00", "type": "openvas", "title": "Ubuntu Update for firefox USN-3991-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11692", "CVE-2019-11696", "CVE-2019-7317", "CVE-2019-9817", "CVE-2019-11699", "CVE-2019-11693", "CVE-2019-9814", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-9819", "CVE-2019-9800", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11701", "CVE-2019-9816", "CVE-2019-11691", "CVE-2019-11695"], "modified": "2019-08-01T00:00:00", "id": "OPENVAS:1361412562310844018", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844018", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844018\");\n script_version(\"2019-08-01T07:22:04+0000\");\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9817\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-9816\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-08-01 07:22:04 +0000 (Thu, 01 Aug 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-22 02:00:58 +0000 (Wed, 22 May 2019)\");\n script_name(\"Ubuntu Update for firefox USN-3991-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.10|UBUNTU19\\.04|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"3991-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-May/004911.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'firefox'\n package(s) announced via the USN-3991-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, spoof the browser\nUI, trick the user in to launching local executable binaries, obtain\nsensitive information, conduct cross-site scripting (XSS) attacks, or\nexecute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,\nCVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701,\nCVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819,\nCVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass\naddon installation prompt delays. If a user opened a specially crafted\nwebsite, an attacker could potentially exploit this to trick them in to\ninstalling a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop\nof hyperlinks to and from bookmarks. If a user were tricked in to dragging\na specially crafted hyperlink to the bookmark toolbar or sidebar, and\nsubsequently back in to the web content area, an attacker could\npotentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects.\nIf a user were tricked in to opening a specially crafted website after\nenabling the UnboxedObjects feature, an attacker could potentially\nexploit this to bypass security checks. (CVE-2019-9816)\");\n\n script_tag(name:\"affected\", value:\"'firefox' package(s) on Ubuntu 19.04, Ubuntu 18.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0+build2-0ubuntu0.18.10.1\", rls:\"UBUNTU18.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0+build2-0ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0+build2-0ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0+build2-0ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-08-01T13:51:33", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-06-07T00:00:00", "type": "openvas", "title": "Ubuntu Update for firefox USN-3991-2", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11692", "CVE-2019-11696", "CVE-2019-7317", "CVE-2019-9817", "CVE-2019-11699", "CVE-2019-11693", "CVE-2019-9814", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-9819", "CVE-2019-9800", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11701", "CVE-2019-9816", "CVE-2019-11691", "CVE-2019-11695"], "modified": "2019-08-01T00:00:00", "id": "OPENVAS:1361412562310844045", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844045", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844045\");\n script_version(\"2019-08-01T07:22:04+0000\");\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9817\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-9816\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-08-01 07:22:04 +0000 (Thu, 01 Aug 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-06-07 02:00:33 +0000 (Fri, 07 Jun 2019)\");\n script_name(\"Ubuntu Update for firefox USN-3991-2\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.10|UBUNTU19\\.04|UBUNTU18\\.04 LTS|UBUNTU16\\.04 LTS)\");\n\n script_xref(name:\"USN\", value:\"3991-2\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-June/004949.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'firefox'\n package(s) announced via the USN-3991-2 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"USN-3991-1 fixed vulnerabilities in Firefox. The update caused a\nregression which resulted in issues when upgrading between Ubuntu\nreleases. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n\u00a0Multiple security issues were discovered in Firefox. If a user were\n\u00a0tricked in to opening a specially crafted website, an attacker could\n\u00a0potentially exploit these to cause a denial of service, spoof the browser\n\u00a0UI, trick the user in to launching local executable binaries, obtain\n\u00a0sensitive information, conduct cross-site scripting (XSS) attacks, or\n\u00a0execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693,\n\u00a0CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701,\n\u00a0CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819,\n\u00a0CVE-2019-9820, CVE-2019-9821)\n\u00a0\n\u00a0It was discovered that pressing certain key combinations could bypass\n\u00a0addon installation prompt delays. If a user opened a specially crafted\n\u00a0website, an attacker could potentially exploit this to trick them in to\n\u00a0installing a malicious extension. (CVE-2019-11697)\n\u00a0\n\u00a0It was discovered that history data could be exposed via drag and drop\n\u00a0of hyperlinks to and from bookmarks. If a user were tricked in to dragging\n\u00a0a specially crafted hyperlink to the bookmark toolbar or sidebar, and\n\u00a0subsequently back in to the web content area, an attacker could\n\u00a0potentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\u00a0\n\u00a0A type confusion bug was discovered with object groups and UnboxedObjects.\n\u00a0If a user were tricked in to opening a specially crafted website after\n\u00a0enabling the UnboxedObjects feature, an attacker could potentially\n\u00a0exploit this to bypass security checks. (CVE-2019-9816)\");\n\n script_tag(name:\"affected\", value:\"'firefox' package(s) on Ubuntu 19.04, Ubuntu 18.10, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.1+build1-0ubuntu0.18.10.1\", rls:\"UBUNTU18.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.1+build1-0ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.1+build1-0ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU16.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"firefox\", ver:\"67.0.1+build1-0ubuntu0.16.04.1\", rls:\"UBUNTU16.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-08-01T13:50:26", "description": "This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-05-22T00:00:00", "type": "openvas", "title": "Mozilla Firefox Security Updates (mfsa_2019-12_2019-13)-Windows", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11692", "CVE-2019-11694", "CVE-2019-11696", "CVE-2019-7317", "CVE-2019-11700", "CVE-2019-9817", "CVE-2019-11699", "CVE-2019-11693", "CVE-2019-9814", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-9819", "CVE-2019-9800", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11701", "CVE-2019-9816", "CVE-2019-11691", "CVE-2019-9815", "CVE-2019-9818", "CVE-2019-11695"], "modified": "2019-08-01T00:00:00", "id": "OPENVAS:1361412562310814895", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310814895", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.814895\");\n script_version(\"2019-08-01T07:22:04+0000\");\n script_cve_id(\"CVE-2019-9815\", \"CVE-2019-9816\", \"CVE-2019-9817\", \"CVE-2019-9818\",\n \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\", \"CVE-2019-11691\",\n \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11694\", \"CVE-2019-11695\",\n \"CVE-2019-11696\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-11700\",\n \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9814\",\n \"CVE-2019-9800\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-08-01 07:22:04 +0000 (Thu, 01 Aug 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-22 12:28:11 +0530 (Wed, 22 May 2019)\");\n script_name(\"Mozilla Firefox Security Updates (mfsa_2019-12_2019-13)-Windows\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - A type confusion error with object groups and UnboxedObjects.\n\n - A buffer overflow error in WebGL bufferdata on Linux.\n\n - A compartment mismatch vulnerability with fetch API.\n\n - Uninitialized memory leakage vulnerability in Windows sandbox.\n\n - Incorrect domain name highlighting during page navigation.\n\n - Memory safety bugs.\n\n - Multiple use-after-free errors in crash generation server, ChromeEventHandler,\n AssertWorkerThread, XMLHttpRequest and libpng library.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of this vulnerability\n will allow remote attackers to bypass security restrictions, conduct spoofing\n attacks, read sensitive data and browser history, crash the application and\n execute arbitrary code.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version before 67 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 67\n or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_firefox_detect_win.nasl\");\n script_mandatory_keys(\"Firefox/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE) ) exit( 0 );\nffVer = infos['version'];\nffPath = infos['location'];\n\nif(version_is_less(version:ffVer, test_version:\"67\"))\n{\n report = report_fixed_ver(installed_version:ffVer, fixed_version:\"67\", install_path:ffPath);\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-08-01T13:50:30", "description": "This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-05-22T00:00:00", "type": "openvas", "title": "Mozilla Firefox Security Updates (mfsa_2019-12_2019-14)-MAC OS X", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11692", "CVE-2019-11694", "CVE-2019-11696", "CVE-2019-7317", "CVE-2019-11700", "CVE-2019-9817", "CVE-2019-11699", "CVE-2019-11693", "CVE-2019-9814", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-9819", "CVE-2019-9800", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11701", "CVE-2019-9816", "CVE-2019-11691", "CVE-2019-9815", "CVE-2019-9818", "CVE-2019-11695"], "modified": "2019-08-01T00:00:00", "id": "OPENVAS:1361412562310814896", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310814896", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\n\nCPE = \"cpe:/a:mozilla:firefox\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.814896\");\n script_version(\"2019-08-01T07:22:04+0000\");\n script_cve_id(\"CVE-2019-9815\", \"CVE-2019-9816\", \"CVE-2019-9817\", \"CVE-2019-9818\",\n \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\", \"CVE-2019-11691\",\n \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11694\", \"CVE-2019-11695\",\n \"CVE-2019-11696\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-11700\",\n \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9814\",\n \"CVE-2019-9800\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-08-01 07:22:04 +0000 (Thu, 01 Aug 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-05-22 12:28:26 +0530 (Wed, 22 May 2019)\");\n script_name(\"Mozilla Firefox Security Updates (mfsa_2019-12_2019-14)-MAC OS X\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Mozilla Firefox\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - A type confusion error with object groups and UnboxedObjects.\n\n - A buffer overflow error in WebGL bufferdata on Linux.\n\n - A compartment mismatch vulnerability with fetch API.\n\n - Uninitialized memory leakage vulnerability in Windows sandbox.\n\n - Incorrect domain name highlighting during page navigation.\n\n - Memory safety bugs.\n\n - Multiple use-after-free errors in crash generation server, ChromeEventHandler,\n AssertWorkerThread, XMLHttpRequest and libpng library.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation of this vulnerability\n will allow remote attackers to bypass security restrictions, conduct spoofing\n attacks, read sensitive data and browser history, crash the application and\n execute arbitrary code.\");\n\n script_tag(name:\"affected\", value:\"Mozilla Firefox version before 67 on Mac OS X\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Mozilla Firefox version 67\n or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_mozilla_prdts_detect_macosx.nasl\");\n script_mandatory_keys(\"Mozilla/Firefox/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( ! infos = get_app_version_and_location( cpe:CPE, exit_no_version:TRUE) ) exit( 0 );\nffVer = infos['version'];\nffPath = infos['location'];\n\nif(version_is_less(version:ffVer, test_version:\"67\"))\n{\n report = report_fixed_ver(installed_version:ffVer, fixed_version:\"67\", install_path:ffPath);\n security_message(data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "nessus": [{"lastseen": "2021-12-23T02:31:40", "description": "Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information.\n(CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks.\n(CVE-2019-9816).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-05-22T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Firefox vulnerabilities (USN-3991-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2020-09-17T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:firefox", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:18.10", "cpe:/o:canonical:ubuntu_linux:19.04"], "id": "UBUNTU_USN-3991-1.NASL", "href": "https://www.tenable.com/plugins/nessus/125339", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3991-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125339);\n script_version(\"1.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/09/17\");\n\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9816\", \"CVE-2019-9817\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\");\n script_xref(name:\"USN\", value:\"3991-1\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Firefox vulnerabilities (USN-3991-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Multiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, spoof the\nbrowser UI, trick the user in to launching local executable binaries,\nobtain sensitive information, conduct cross-site scripting (XSS)\nattacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692,\nCVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699,\nCVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814,\nCVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass\naddon installation prompt delays. If a user opened a specially crafted\nwebsite, an attacker could potentially exploit this to trick them in\nto installing a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop\nof hyperlinks to and from bookmarks. If a user were tricked in to\ndragging a specially crafted hyperlink to the bookmark toolbar or\nsidebar, and subsequently back in to the web content area, an attacker\ncould potentially exploit this to obtain sensitive information.\n(CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and\nUnboxedObjects. If a user were tricked in to opening a specially\ncrafted website after enabling the UnboxedObjects feature, an attacker\ncould potentially exploit this to bypass security checks.\n(CVE-2019-9816).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3991-1/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/22\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|18\\.10|19\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04 / 18.10 / 19.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"firefox\", pkgver:\"67.0+build2-0ubuntu0.16.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"firefox\", pkgver:\"67.0+build2-0ubuntu0.18.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.10\", pkgname:\"firefox\", pkgver:\"67.0+build2-0ubuntu0.18.10.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"firefox\", pkgver:\"67.0+build2-0ubuntu0.19.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"firefox\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-18T15:04:29", "description": "USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a subsequent regression. The update caused an additional regression that resulted in Firefox failing to load correctly after executing it in safe mode. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nMultiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information.\n(CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks.\n(CVE-2019-9816).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-06-17T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Firefox regression (USN-3991-3)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:firefox", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:18.10", "cpe:/o:canonical:ubuntu_linux:19.04"], "id": "UBUNTU_USN-3991-3.NASL", "href": "https://www.tenable.com/plugins/nessus/125948", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3991-3. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125948);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9816\", \"CVE-2019-9817\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\");\n script_xref(name:\"USN\", value:\"3991-3\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0025\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : Firefox regression (USN-3991-3)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a\nsubsequent regression. The update caused an additional regression that\nresulted in Firefox failing to load correctly after executing it in\nsafe mode. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nMultiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, spoof the\nbrowser UI, trick the user in to launching local executable binaries,\nobtain sensitive information, conduct cross-site scripting (XSS)\nattacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692,\nCVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699,\nCVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814,\nCVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass\naddon installation prompt delays. If a user opened a specially crafted\nwebsite, an attacker could potentially exploit this to trick them in\nto installing a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop\nof hyperlinks to and from bookmarks. If a user were tricked in to\ndragging a specially crafted hyperlink to the bookmark toolbar or\nsidebar, and subsequently back in to the web content area, an attacker\ncould potentially exploit this to obtain sensitive information.\n(CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and\nUnboxedObjects. If a user were tricked in to opening a specially\ncrafted website after enabling the UnboxedObjects feature, an attacker\ncould potentially exploit this to bypass security checks.\n(CVE-2019-9816).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3991-3/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/17\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2023 Canonical, Inc. / NASL script (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|18\\.10|19\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04 / 18.10 / 19.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"firefox\", pkgver:\"67.0.2+build2-0ubuntu0.16.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"firefox\", pkgver:\"67.0.2+build2-0ubuntu0.18.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.10\", pkgname:\"firefox\", pkgver:\"67.0.2+build2-0ubuntu0.18.10.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"firefox\", pkgver:\"67.0.2+build2-0ubuntu0.19.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"firefox\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-17T23:38:55", "description": "USN-3991-1 fixed vulnerabilities in Firefox. The update caused a regression which resulted in issues when upgrading between Ubuntu releases. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details :\n\nMultiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-06-07T00:00:00", "type": "nessus", "title": "Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : firefox regression (USN-3991-2)", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2023-01-12T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:firefox", "cpe:/o:canonical:ubuntu_linux:16.04", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "cpe:/o:canonical:ubuntu_linux:18.10", "cpe:/o:canonical:ubuntu_linux:19.04"], "id": "UBUNTU_USN-3991-2.NASL", "href": "https://www.tenable.com/plugins/nessus/125766", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3991-2. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125766);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/01/12\");\n\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-11699\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9816\", \"CVE-2019-9817\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\");\n script_xref(name:\"USN\", value:\"3991-2\");\n script_xref(name:\"CEA-ID\", value:\"CEA-2021-0025\");\n\n script_name(english:\"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : firefox regression (USN-3991-2)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"USN-3991-1 fixed vulnerabilities in Firefox. The update caused a\nregression which resulted in issues when upgrading between Ubuntu\nreleases. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details :\n\nMultiple security issues were discovered in Firefox. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit these to cause a denial of service, spoof the\nbrowser UI, trick the user in to launching local executable binaries,\nobtain sensitive information, conduct cross-site scripting (XSS)\nattacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692,\nCVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699,\nCVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814,\nCVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations\ncould bypass addon installation prompt delays. If a user\nopened a specially crafted website, an attacker could\npotentially exploit this to trick them in to installing a\nmalicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via\ndrag and drop of hyperlinks to and from bookmarks. If a user\nwere tricked in to dragging a specially crafted hyperlink to\nthe bookmark toolbar or sidebar, and subsequently back in to\nthe web content area, an attacker could potentially exploit\nthis to obtain sensitive information. (CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and\nUnboxedObjects. If a user were tricked in to opening a\nspecially crafted website after enabling the UnboxedObjects\nfeature, an attacker could potentially exploit this to\nbypass security checks. (CVE-2019-9816).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3991-2/\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected firefox package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:19.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/07\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2023 Canonical, Inc. / NASL script (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nvar release = chomp(release);\nif (! preg(pattern:\"^(16\\.04|18\\.04|18\\.10|19\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 16.04 / 18.04 / 18.10 / 19.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar flag = 0;\n\nif (ubuntu_check(osver:\"16.04\", pkgname:\"firefox\", pkgver:\"67.0.1+build1-0ubuntu0.16.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.04\", pkgname:\"firefox\", pkgver:\"67.0.1+build1-0ubuntu0.18.04.1\")) flag++;\nif (ubuntu_check(osver:\"18.10\", pkgname:\"firefox\", pkgver:\"67.0.1+build1-0ubuntu0.18.10.1\")) flag++;\nif (ubuntu_check(osver:\"19.04\", pkgname:\"firefox\", pkgver:\"67.0.1+build1-0ubuntu0.19.04.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"firefox\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-02-17T23:25:05", "description": "The version of Firefox installed on the remote host is prior to 67.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-13 advisory:\n\n - If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. (CVE-2019-9815)\n - A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases. (CVE-2019-9816)\n - Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. (CVE-2019-9817)\n - A race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. Note: this vulnerability only affects Windows. Other operating systems are unaffected. (CVE-2019-9818)\n - A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. (CVE-2019-9819)\n - A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. (CVE-2019-9820)\n - A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. (CVE-2019-9821)\n - A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. (CVE-2019-11691)\n - A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. (CVE-2019-11692)\n - The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected. (CVE-2019-11693)\n - A use-after-free vulnerability was discovered in the png_image_free function in the libpng library. This could lead to denial of service or a potentially exploitable crash when a malformed image is processed. (CVE-2019-7317)\n - A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. Note: this issue only occurs on Windows. Other operating systems are unaffected. (CVE-2019-11694)\n - A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. (CVE-2019-11695)\n - Files with the .JNLP extension used for 'Java web start' applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. (CVE-2019-11696)\n - If the ALT and 'a' keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension. (CVE-2019-11697)\n - If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. (CVE-2019-11698)\n - A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. Note: this issue only occurs on Windows. Other operating systems are unaffected. (CVE-2019-11700)\n - A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks. (CVE-2019-11699)\n - The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected. (CVE-2019-11701)\n - Mozilla developers and community members Christian Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan Varga, Marcia Knous, Andre Bargull, and Philipp reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2019-9814)\n - Mozilla developers and community members Olli Pettay, Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga, Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald Crane, and Ted Campbell reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2019-9800)\n\n Note that NNM has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-05-21T00:00:00", "type": "nessus", "title": "Mozilla Firefox < 67.0 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11694", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11700", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9815", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9818", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-05-21T00:00:00", "cpe": ["cpe:/a:mozilla:firefox"], "id": "700727.PRM", "href": "https://www.tenable.com/plugins/nnm/700727", "sourceData": "Binary data 700727.prm", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-23T02:32:26", "description": "The version of Firefox installed on the remote macOS or Mac OS X host is prior to 67.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-13 advisory.\n\n - If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. Note: users need to update to macOS 10.14.5 in order to take advantage of this change.\n (CVE-2019-9815)\n\n - A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.\n (CVE-2019-9816)\n\n - Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. (CVE-2019-9817)\n\n - A race condition is present in the crash generation server used to generate data for the crash reporter.\n This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. Note: this vulnerability only affects Windows. Other operating systems are unaffected.\n (CVE-2019-9818)\n\n - A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash.\n (CVE-2019-9819)\n\n - A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash.\n (CVE-2019-9820)\n\n - A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. (CVE-2019-9821)\n\n - A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. (CVE-2019-11691)\n\n - A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash.\n (CVE-2019-11692)\n\n - The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected. (CVE-2019-11693)\n\n - A use-after-free vulnerability was discovered in the pngimagefree function in the libpng library. This could lead to denial of service or a potentially exploitable crash when a malformed image is processed. (CVE-2019-7317)\n\n - A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. Note: this issue only occurs on Windows.\n Other operating systems are unaffected. (CVE-2019-11694)\n\n - A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. (CVE-2019-11695)\n\n - Files with the .JNLP extension used for Java web start applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. (CVE-2019-11696)\n\n - If the ALT and a keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension.\n (CVE-2019-11697)\n\n - If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. (CVE-2019-11698)\n\n - A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted.\n Note: this issue only occurs on Windows. Other operating systems are unaffected. (CVE-2019-11700)\n\n - A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks.\n (CVE-2019-11699)\n\n - The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected. (CVE-2019-11701)\n\n - Mozilla developers and community members Christian Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan Varga, Marcia Knous, Andr Bargull, and Philipp reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2019-9814)\n\n - Mozilla developers and community members Olli Pettay, Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga, Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald Crane, and Ted Campbell reported memory safety bugs present in Firefox 66 and Firefox ESR 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2019-9800)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2019-05-23T00:00:00", "type": "nessus", "title": "Mozilla Firefox < 67.0", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9815", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9818", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11694", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11700", "CVE-2019-11701"], "modified": "2019-10-30T00:00:00", "cpe": ["cpe:/a:mozilla:firefox"], "id": "MACOS_FIREFOX_67_0.NASL", "href": "https://www.tenable.com/plugins/nessus/125360", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from Mozilla Foundation Security Advisory mfsa2019-13.\n# The text itself is copyright (C) Mozilla Foundation.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125360);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/10/30 13:24:46\");\n\n script_cve_id(\n \"CVE-2019-7317\",\n \"CVE-2019-9800\",\n \"CVE-2019-9814\",\n \"CVE-2019-9815\",\n \"CVE-2019-9816\",\n \"CVE-2019-9817\",\n \"CVE-2019-9818\",\n \"CVE-2019-9819\",\n \"CVE-2019-9820\",\n \"CVE-2019-9821\",\n \"CVE-2019-11691\",\n \"CVE-2019-11692\",\n \"CVE-2019-11693\",\n \"CVE-2019-11694\",\n \"CVE-2019-11695\",\n \"CVE-2019-11696\",\n \"CVE-2019-11697\",\n \"CVE-2019-11698\",\n \"CVE-2019-11699\",\n \"CVE-2019-11700\",\n \"CVE-2019-11701\"\n );\n script_bugtraq_id(\n 108098,\n 108418,\n 108421\n );\n script_xref(name:\"MFSA\", value:\"2019-13\");\n\n script_name(english:\"Mozilla Firefox < 67.0\");\n script_summary(english:\"Checks the version of Firefox.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote macOS or Mac OS X host is\naffected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Firefox installed on the remote macOS or Mac OS X host\nis prior to 67.0. It is, therefore, affected by multiple\nvulnerabilities as referenced in the mfsa2019-13 advisory.\n\n - If hyperthreading is not disabled, a timing attack\n vulnerability exists, similar to previous Spectre\n attacks. Apple has shipped macOS 10.14.5 with an option\n to disable hyperthreading in applications running\n untrusted code in a thread through a new sysctl. Firefox\n now makes use of it on the main thread and any worker\n threads. Note: users need to update to macOS 10.14.5\n in order to take advantage of this change.\n (CVE-2019-9815)\n\n - A possible vulnerability exists where type confusion can\n occur when manipulating JavaScript objects in object\n groups, allowing for the bypassing of security checks\n within these groups. Note: this vulnerability has\n only been demonstrated with UnboxedObjects,\n which are disabled by default on all supported releases.\n (CVE-2019-9816)\n\n - Images from a different domain can be read using a\n canvas object in some circumstances. This could be used\n to steal image data from a different site in violation\n of same-origin policy. (CVE-2019-9817)\n\n - A race condition is present in the crash generation\n server used to generate data for the crash reporter.\n This issue can lead to a use-after-free in the main\n process, resulting in a potentially exploitable crash\n and a sandbox escape. Note: this vulnerability only\n affects Windows. Other operating systems are unaffected.\n (CVE-2019-9818)\n\n - A vulnerability where a JavaScript compartment mismatch\n can occur while working with the fetch API,\n resulting in a potentially exploitable crash.\n (CVE-2019-9819)\n\n - A use-after-free vulnerability can occur in the chrome\n event handler when it is freed while still in use. This\n results in a potentially exploitable crash.\n (CVE-2019-9820)\n\n - A use-after-free vulnerability can occur in\n AssertWorkerThread due to a race condition\n with shared workers. This results in a potentially\n exploitable crash. (CVE-2019-9821)\n\n - A use-after-free vulnerability can occur when working\n with XMLHttpRequest (XHR) in an event loop,\n causing the XHR main thread to be called after it has\n been freed. This results in a potentially exploitable\n crash. (CVE-2019-11691)\n\n - A use-after-free vulnerability can occur when listeners\n are removed from the event listener manager while still\n in use, resulting in a potentially exploitable crash.\n (CVE-2019-11692)\n\n - The bufferdata function in WebGL is\n vulnerable to a buffer overflow with specific graphics\n drivers on Linux. This could result in malicious content\n freezing a tab or triggering a potentially exploitable\n crash. Note: this issue only occurs on Linux. Other\n operating systems are unaffected. (CVE-2019-11693)\n\n - A use-after-free vulnerability was discovered in the\n pngimagefree function in the libpng\n library. This could lead to denial of service or a\n potentially exploitable crash when a malformed image is\n processed. (CVE-2019-7317)\n\n - A vulnerability exists in the Windows sandbox where an\n uninitialized value in memory can be leaked to a\n renderer from a broker when making a call to access an\n otherwise unavailable file. This results in the\n potential leaking of information stored at that memory\n location. Note: this issue only occurs on Windows.\n Other operating systems are unaffected. (CVE-2019-11694)\n\n - A custom cursor defined by scripting on a site can\n position itself over the addressbar to spoof the actual\n cursor when it should not be allowed outside of the\n primary web content area. This could be used by a\n malicious site to trick users into clicking on\n permission prompts, doorhanger notifications, or other\n buttons inadvertently if the location is spoofed over\n the user interface. (CVE-2019-11695)\n\n - Files with the .JNLP extension used for\n Java web start applications are not treated as\n executable content for download prompts even though they\n can be executed if Java is installed on the local\n system. This could allow users to mistakenly launch an\n executable binary locally. (CVE-2019-11696)\n\n - If the ALT and a keys are pressed when\n users receive an extension installation prompt, the\n extension will be installed without the install prompt\n delay that keeps the prompt visible in order for users\n to accept or decline the installation. A malicious web\n page could use this with spoofing on the page to trick\n users into installing a malicious extension.\n (CVE-2019-11697)\n\n - If a crafted hyperlink is dragged and dropped to the\n bookmark bar or sidebar and the resulting bookmark is\n subsequently dragged and dropped into the web content\n area, an arbitrary query of a user's browser history can\n be run and transmitted to the content page via\n drop event data. This allows for the theft\n of browser history by a malicious site. (CVE-2019-11698)\n\n - A hyperlink using the res: protocol can be\n used to open local files at a known location in Internet\n Explorer if a user approves execution when prompted.\n Note: this issue only occurs on Windows. Other\n operating systems are unaffected. (CVE-2019-11700)\n\n - A malicious page can briefly cause the wrong name to be\n highlighted as the domain name in the addressbar during\n page navigations. This could result in user confusion of\n which site is currently loaded for spoofing attacks.\n (CVE-2019-11699)\n\n - The default webcal: protocol handler will\n load a web site vulnerable to cross-site scripting (XSS)\n attacks. This default was left in place as a legacy\n feature and has now been removed. Note: this issue\n only affects users with an account on the vulnerable\n service. Other users are unaffected. (CVE-2019-11701)\n\n - Mozilla developers and community members Christian\n Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan\n Varga, Marcia Knous, Andr Bargull, and Philipp reported\n memory safety bugs present in Firefox 66. Some of these\n bugs showed evidence of memory corruption and we presume\n that with enough effort that some of these could be\n exploited to run arbitrary code. (CVE-2019-9814)\n\n - Mozilla developers and community members Olli Pettay,\n Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga,\n Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald\n Crane, and Ted Campbell reported memory safety bugs\n present in Firefox 66 and Firefox ESR 60.6. Some of\n these bugs showed evidence of memory corruption and we\n presume that with enough effort that some of these could\n be exploited to run arbitrary code. (CVE-2019-9800)\n\nNote that Nessus has not tested for this issue but has instead relied\nonly on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox version 67.0 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-9820\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/23\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"macosx_firefox_installed.nasl\");\n script_require_keys(\"MacOSX/Firefox/Installed\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nkb_base = \"MacOSX/Firefox\";\nget_kb_item_or_exit(kb_base+\"/Installed\");\n\nversion = get_kb_item_or_exit(kb_base+\"/Version\", exit_code:1);\npath = get_kb_item_or_exit(kb_base+\"/Path\", exit_code:1);\n\nis_esr = get_kb_item(kb_base+\"/is_esr\");\nif (is_esr) exit(0, 'The Mozilla Firefox installation is in the ESR branch.');\n\nmozilla_check_version(version:version, path:path, product:'firefox', esr:FALSE, fix:'67.0', xss:TRUE, severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-23T02:31:40", "description": "Mozilla Foundation reports :\n\nCVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS\n\nCVE-2019-9816: Type confusion with object groups and UnboxedObjects\n\nCVE-2019-9817: Stealing of cross-domain images using canvas\n\nCVE-2019-9818: Use-after-free in crash generation server\n\nCVE-2019-9819: Compartment mismatch with fetch API\n\nCVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell\n\nCVE-2019-9821: Use-after-free in AssertWorkerThread\n\nCVE-2019-11691: Use-after-free in XMLHttpRequest\n\nCVE-2019-11692: Use-after-free removing listeners in the event listener manager\n\nCVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux\n\nCVE-2019-7317: Use-after-free in png_image_free of libpng library\n\nCVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox\n\nCVE-2019-11695: Custom cursor can render over user interface outside of web content\n\nCVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts\n\nCVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions\n\nCVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks\n\nCVE-2019-11700: res: protocol can be used to open known local files\n\nCVE-2019-11699: Incorrect domain name highlighting during page navigation\n\nCVE-2019-11701: webcal: protocol default handler loads vulnerable web page\n\nCVE-2019-9814: Memory safety bugs fixed in Firefox 67\n\nCVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "cvss3": {}, "published": "2019-05-23T00:00:00", "type": "nessus", "title": "FreeBSD : mozilla -- multiple vulnerabilities (44b6dfbf-4ef7-4d52-ad52-2b1b05d81272)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11694", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11700", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9815", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9818", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-07-26T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:firefox", "p-cpe:/a:freebsd:freebsd:firefox-esr", "p-cpe:/a:freebsd:freebsd:libxul", "p-cpe:/a:freebsd:freebsd:linux-firefox", "p-cpe:/a:freebsd:freebsd:linux-seamonkey", "p-cpe:/a:freebsd:freebsd:linux-thunderbird", "p-cpe:/a:freebsd:freebsd:seamonkey", "p-cpe:/a:freebsd:freebsd:thunderbird", "p-cpe:/a:freebsd:freebsd:waterfox", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_44B6DFBF4EF74D52AD522B1B05D81272.NASL", "href": "https://www.tenable.com/plugins/nessus/125346", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125346);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/07/26 16:46:13\");\n\n script_cve_id(\"CVE-2019-11691\", \"CVE-2019-11692\", \"CVE-2019-11693\", \"CVE-2019-11694\", \"CVE-2019-11695\", \"CVE-2019-11696\", \"CVE-2019-11697\", \"CVE-2019-11698\", \"CVE-2019-11699\", \"CVE-2019-11700\", \"CVE-2019-11701\", \"CVE-2019-7317\", \"CVE-2019-9800\", \"CVE-2019-9814\", \"CVE-2019-9815\", \"CVE-2019-9816\", \"CVE-2019-9817\", \"CVE-2019-9818\", \"CVE-2019-9819\", \"CVE-2019-9820\", \"CVE-2019-9821\");\n\n script_name(english:\"FreeBSD : mozilla -- multiple vulnerabilities (44b6dfbf-4ef7-4d52-ad52-2b1b05d81272)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mozilla Foundation reports :\n\nCVE-2019-9815: Disable hyperthreading on content JavaScript threads on\nmacOS\n\nCVE-2019-9816: Type confusion with object groups and UnboxedObjects\n\nCVE-2019-9817: Stealing of cross-domain images using canvas\n\nCVE-2019-9818: Use-after-free in crash generation server\n\nCVE-2019-9819: Compartment mismatch with fetch API\n\nCVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell\n\nCVE-2019-9821: Use-after-free in AssertWorkerThread\n\nCVE-2019-11691: Use-after-free in XMLHttpRequest\n\nCVE-2019-11692: Use-after-free removing listeners in the event\nlistener manager\n\nCVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux\n\nCVE-2019-7317: Use-after-free in png_image_free of libpng library\n\nCVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox\n\nCVE-2019-11695: Custom cursor can render over user interface outside\nof web content\n\nCVE-2019-11696: Java web start .JNLP files are not recognized as\nexecutable files for download prompts\n\nCVE-2019-11697: Pressing key combinations can bypass installation\nprompt delays and install extensions\n\nCVE-2019-11698: Theft of user history data through drag and drop of\nhyperlinks to and from bookmarks\n\nCVE-2019-11700: res: protocol can be used to open known local files\n\nCVE-2019-11699: Incorrect domain name highlighting during page\nnavigation\n\nCVE-2019-11701: webcal: protocol default handler loads vulnerable web\npage\n\nCVE-2019-9814: Memory safety bugs fixed in Firefox 67\n\nCVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR\n60.7\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.mozilla.org/security/advisories/mfsa2019-13/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.mozilla.org/security/advisories/mfsa2019-14/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.mozilla.org/security/advisories/mfsa2019-15/\"\n );\n # https://vuxml.freebsd.org/freebsd/44b6dfbf-4ef7-4d52-ad52-2b1b05d81272.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?92883668\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:firefox-esr\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:libxul\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:linux-firefox\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:linux-seamonkey\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:linux-thunderbird\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:seamonkey\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:thunderbird\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:waterfox\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/05/21\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"firefox<67.0,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"waterfox<56.2.10\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"seamonkey<2.53.0\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"linux-seamonkey<2.53.0\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"firefox-esr<60.7.0,1\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"linux-firefox<60.7.0,2\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"libxul<60.7.0\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"thunderbird<60.7.0\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"linux-thunderbird<60.7.0\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-12-23T02:31:39", "description": "The version of Firefox installed on the remote Windows host is prior to 67.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-13 advisory.\n\n - If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. Note: users need to update to macOS 10.14.5 in order to take advantage of this change.\n (CVE-2019-9815)\n\n - A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.\n (CVE-2019-9816)\n\n - Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. (CVE-2019-9817)\n\n - A race condition is present in the crash generation server used to generate data for the crash reporter.\n This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. Note: this vulnerability only affects Windows. Other operating systems are unaffected.\n (CVE-2019-9818)\n\n - A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash.\n (CVE-2019-9819)\n\n - A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash.\n (CVE-2019-9820)\n\n - A use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash. (CVE-2019-9821)\n\n - A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. (CVE-2019-11691)\n\n - A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash.\n (CVE-2019-11692)\n\n - The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected. (CVE-2019-11693)\n\n - A use-after-free vulnerability was discovered in the pngimagefree function in the libpng library. This could lead to denial of service or a potentially exploitable crash when a malformed image is processed. (CVE-2019-7317)\n\n - A vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. Note: this issue only occurs on Windows.\n Other operating systems are unaffected. (CVE-2019-11694)\n\n - A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface. (CVE-2019-11695)\n\n - Files with the .JNLP extension used for Java web start applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally. (CVE-2019-11696)\n\n - If the ALT and a keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension.\n (CVE-2019-11697)\n\n - If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. (CVE-2019-11698)\n\n - A hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted.\n Note: this issue only occurs on Windows. Other operating systems are unaffected. (CVE-2019-11700)\n\n - A malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks.\n (CVE-2019-11699)\n\n - The default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected. (CVE-2019-11701)\n\n - Mozilla developers and community members Christian Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan Varga, Marcia Knous, Andr Bargull, and Philipp reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2019-9814)\n\n - Mozilla developers and community members Olli Pettay, Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga, Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald Crane, and Ted Campbell reported memory safety bugs present in Firefox 66 and Firefox ESR 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2019-9800)\n\nNote that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2019-05-23T00:00:00", "type": "nessus", "title": "Mozilla Firefox < 67.0", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9815", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9818", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11694", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11700", "CVE-2019-11701"], "modified": "2019-10-30T00:00:00", "cpe": ["cpe:/a:mozilla:firefox"], "id": "MOZILLA_FIREFOX_67_0.NASL", "href": "https://www.tenable.com/plugins/nessus/125361", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n# The descriptive text and package checks in this plugin were\n# extracted from Mozilla Foundation Security Advisory mfsa2019-13.\n# The text itself is copyright (C) Mozilla Foundation.\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(125361);\n script_version(\"1.5\");\n script_cvs_date(\"Date: 2019/10/30 13:24:47\");\n\n script_cve_id(\n \"CVE-2019-7317\",\n \"CVE-2019-9800\",\n \"CVE-2019-9814\",\n \"CVE-2019-9815\",\n \"CVE-2019-9816\",\n \"CVE-2019-9817\",\n \"CVE-2019-9818\",\n \"CVE-2019-9819\",\n \"CVE-2019-9820\",\n \"CVE-2019-9821\",\n \"CVE-2019-11691\",\n \"CVE-2019-11692\",\n \"CVE-2019-11693\",\n \"CVE-2019-11694\",\n \"CVE-2019-11695\",\n \"CVE-2019-11696\",\n \"CVE-2019-11697\",\n \"CVE-2019-11698\",\n \"CVE-2019-11699\",\n \"CVE-2019-11700\",\n \"CVE-2019-11701\"\n );\n script_bugtraq_id(\n 108098,\n 108418,\n 108421\n );\n script_xref(name:\"MFSA\", value:\"2019-13\");\n\n script_name(english:\"Mozilla Firefox < 67.0\");\n script_summary(english:\"Checks the version of Firefox.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A web browser installed on the remote Windows host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Firefox installed on the remote Windows host is prior\nto 67.0. It is, therefore, affected by multiple vulnerabilities as\nreferenced in the mfsa2019-13 advisory.\n\n - If hyperthreading is not disabled, a timing attack\n vulnerability exists, similar to previous Spectre\n attacks. Apple has shipped macOS 10.14.5 with an option\n to disable hyperthreading in applications running\n untrusted code in a thread through a new sysctl. Firefox\n now makes use of it on the main thread and any worker\n threads. Note: users need to update to macOS 10.14.5\n in order to take advantage of this change.\n (CVE-2019-9815)\n\n - A possible vulnerability exists where type confusion can\n occur when manipulating JavaScript objects in object\n groups, allowing for the bypassing of security checks\n within these groups. Note: this vulnerability has\n only been demonstrated with UnboxedObjects,\n which are disabled by default on all supported releases.\n (CVE-2019-9816)\n\n - Images from a different domain can be read using a\n canvas object in some circumstances. This could be used\n to steal image data from a different site in violation\n of same-origin policy. (CVE-2019-9817)\n\n - A race condition is present in the crash generation\n server used to generate data for the crash reporter.\n This issue can lead to a use-after-free in the main\n process, resulting in a potentially exploitable crash\n and a sandbox escape. Note: this vulnerability only\n affects Windows. Other operating systems are unaffected.\n (CVE-2019-9818)\n\n - A vulnerability where a JavaScript compartment mismatch\n can occur while working with the fetch API,\n resulting in a potentially exploitable crash.\n (CVE-2019-9819)\n\n - A use-after-free vulnerability can occur in the chrome\n event handler when it is freed while still in use. This\n results in a potentially exploitable crash.\n (CVE-2019-9820)\n\n - A use-after-free vulnerability can occur in\n AssertWorkerThread due to a race condition\n with shared workers. This results in a potentially\n exploitable crash. (CVE-2019-9821)\n\n - A use-after-free vulnerability can occur when working\n with XMLHttpRequest (XHR) in an event loop,\n causing the XHR main thread to be called after it has\n been freed. This results in a potentially exploitable\n crash. (CVE-2019-11691)\n\n - A use-after-free vulnerability can occur when listeners\n are removed from the event listener manager while still\n in use, resulting in a potentially exploitable crash.\n (CVE-2019-11692)\n\n - The bufferdata function in WebGL is\n vulnerable to a buffer overflow with specific graphics\n drivers on Linux. This could result in malicious content\n freezing a tab or triggering a potentially exploitable\n crash. Note: this issue only occurs on Linux. Other\n operating systems are unaffected. (CVE-2019-11693)\n\n - A use-after-free vulnerability was discovered in the\n pngimagefree function in the libpng\n library. This could lead to denial of service or a\n potentially exploitable crash when a malformed image is\n processed. (CVE-2019-7317)\n\n - A vulnerability exists in the Windows sandbox where an\n uninitialized value in memory can be leaked to a\n renderer from a broker when making a call to access an\n otherwise unavailable file. This results in the\n potential leaking of information stored at that memory\n location. Note: this issue only occurs on Windows.\n Other operating systems are unaffected. (CVE-2019-11694)\n\n - A custom cursor defined by scripting on a site can\n position itself over the addressbar to spoof the actual\n cursor when it should not be allowed outside of the\n primary web content area. This could be used by a\n malicious site to trick users into clicking on\n permission prompts, doorhanger notifications, or other\n buttons inadvertently if the location is spoofed over\n the user interface. (CVE-2019-11695)\n\n - Files with the .JNLP extension used for\n Java web start applications are not treated as\n executable content for download prompts even though they\n can be executed if Java is installed on the local\n system. This could allow users to mistakenly launch an\n executable binary locally. (CVE-2019-11696)\n\n - If the ALT and a keys are pressed when\n users receive an extension installation prompt, the\n extension will be installed without the install prompt\n delay that keeps the prompt visible in order for users\n to accept or decline the installation. A malicious web\n page could use this with spoofing on the page to trick\n users into installing a malicious extension.\n (CVE-2019-11697)\n\n - If a crafted hyperlink is dragged and dropped to the\n bookmark bar or sidebar and the resulting bookmark is\n subsequently dragged and dropped into the web content\n area, an arbitrary query of a user's browser history can\n be run and transmitted to the content page via\n drop event data. This allows for the theft\n of browser history by a malicious site. (CVE-2019-11698)\n\n - A hyperlink using the res: protocol can be\n used to open local files at a known location in Internet\n Explorer if a user approves execution when prompted.\n Note: this issue only occurs on Windows. Other\n operating systems are unaffected. (CVE-2019-11700)\n\n - A malicious page can briefly cause the wrong name to be\n highlighted as the domain name in the addressbar during\n page navigations. This could result in user confusion of\n which site is currently loaded for spoofing attacks.\n (CVE-2019-11699)\n\n - The default webcal: protocol handler will\n load a web site vulnerable to cross-site scripting (XSS)\n attacks. This default was left in place as a legacy\n feature and has now been removed. Note: this issue\n only affects users with an account on the vulnerable\n service. Other users are unaffected. (CVE-2019-11701)\n\n - Mozilla developers and community members Christian\n Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan\n Varga, Marcia Knous, Andr Bargull, and Philipp reported\n memory safety bugs present in Firefox 66. Some of these\n bugs showed evidence of memory corruption and we presume\n that with enough effort that some of these could be\n exploited to run arbitrary code. (CVE-2019-9814)\n\n - Mozilla developers and community members Olli Pettay,\n Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga,\n Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald\n Crane, and Ted Campbell reported memory safety bugs\n present in Firefox 66 and Firefox ESR 60.6. Some of\n these bugs showed evidence of memory corruption and we\n presume that with enough effort that some of these could\n be exploited to run arbitrary code. (CVE-2019-9800)\n\nNote that Nessus has not tested for this issue but has instead relied\nonly on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Mozilla Firefox version 67.0 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-9820\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/02/04\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/05/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/05/23\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:mozilla:firefox\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"mozilla_org_installed.nasl\");\n script_require_keys(\"Mozilla/Firefox/Version\");\n\n exit(0);\n}\n\ninclude(\"mozilla_version.inc\");\n\nport = get_kb_item(\"SMB/transport\");\nif (!port) port = 445;\n\ninstalls = get_kb_list(\"SMB/Mozilla/Firefox/*\");\nif (isnull(installs)) audit(AUDIT_NOT_INST, \"Firefox\");\n\nmozilla_check_version(installs:installs, product:'firefox', esr:FALSE, fix:'67.0', xss:TRUE, severity:SECURITY_HOLE);\n", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2023-01-26T15:46:22", "description": "## Releases\n\n * Ubuntu 19.04 \n * Ubuntu 18.10 \n * Ubuntu 18.04 LTS\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * firefox \\- Mozilla Open Source web browser\n\nUSN-3991-1 fixed vulnerabilities in Firefox. The update caused a \nregression which resulted in issues when upgrading between Ubuntu \nreleases. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nMultiple security issues were discovered in Firefox. If a user were \ntricked in to opening a specially crafted website, an attacker could \npotentially exploit these to cause a denial of service, spoof the browser \nUI, trick the user in to launching local executable binaries, obtain \nsensitive information, conduct cross-site scripting (XSS) attacks, or \nexecute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, \nCVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, \nCVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, \nCVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass \naddon installation prompt delays. If a user opened a specially crafted \nwebsite, an attacker could potentially exploit this to trick them in to \ninstalling a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop \nof hyperlinks to and from bookmarks. If a user were tricked in to dragging \na specially crafted hyperlink to the bookmark toolbar or sidebar, and \nsubsequently back in to the web content area, an attacker could \npotentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects. \nIf a user were tricked in to opening a specially crafted website after \nenabling the UnboxedObjects feature, an attacker could potentially \nexploit this to bypass security checks. (CVE-2019-9816)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-06-06T00:00:00", "type": "ubuntu", "title": "Firefox regression", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-06-06T00:00:00", "id": "USN-3991-2", "href": "https://ubuntu.com/security/notices/USN-3991-2", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-26T15:46:49", "description": "## Releases\n\n * Ubuntu 19.04 \n * Ubuntu 18.10 \n * Ubuntu 18.04 LTS\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * firefox \\- Mozilla Open Source web browser\n\nMultiple security issues were discovered in Firefox. If a user were \ntricked in to opening a specially crafted website, an attacker could \npotentially exploit these to cause a denial of service, spoof the browser \nUI, trick the user in to launching local executable binaries, obtain \nsensitive information, conduct cross-site scripting (XSS) attacks, or \nexecute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, \nCVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, \nCVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, \nCVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass \naddon installation prompt delays. If a user opened a specially crafted \nwebsite, an attacker could potentially exploit this to trick them in to \ninstalling a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop \nof hyperlinks to and from bookmarks. If a user were tricked in to dragging \na specially crafted hyperlink to the bookmark toolbar or sidebar, and \nsubsequently back in to the web content area, an attacker could \npotentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects. \nIf a user were tricked in to opening a specially crafted website after \nenabling the UnboxedObjects feature, an attacker could potentially \nexploit this to bypass security checks. (CVE-2019-9816)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-05-21T00:00:00", "type": "ubuntu", "title": "Firefox vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-05-21T00:00:00", "id": "USN-3991-1", "href": "https://ubuntu.com/security/notices/USN-3991-1", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-01-26T15:46:15", "description": "## Releases\n\n * Ubuntu 19.04 \n * Ubuntu 18.10 \n * Ubuntu 18.04 LTS\n * Ubuntu 16.04 ESM\n\n## Packages\n\n * firefox \\- Mozilla Open Source web browser\n\nUSN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a \nsubsequent regression. The update caused an additional regression that \nresulted in Firefox failing to load correctly after executing it in safe \nmode. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\nMultiple security issues were discovered in Firefox. If a user were \ntricked in to opening a specially crafted website, an attacker could \npotentially exploit these to cause a denial of service, spoof the browser \nUI, trick the user in to launching local executable binaries, obtain \nsensitive information, conduct cross-site scripting (XSS) attacks, or \nexecute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, \nCVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, \nCVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, \nCVE-2019-9820, CVE-2019-9821)\n\nIt was discovered that pressing certain key combinations could bypass \naddon installation prompt delays. If a user opened a specially crafted \nwebsite, an attacker could potentially exploit this to trick them in to \ninstalling a malicious extension. (CVE-2019-11697)\n\nIt was discovered that history data could be exposed via drag and drop \nof hyperlinks to and from bookmarks. If a user were tricked in to dragging \na specially crafted hyperlink to the bookmark toolbar or sidebar, and \nsubsequently back in to the web content area, an attacker could \npotentially exploit this to obtain sensitive information. (CVE-2019-11698)\n\nA type confusion bug was discovered with object groups and UnboxedObjects. \nIf a user were tricked in to opening a specially crafted website after \nenabling the UnboxedObjects feature, an attacker could potentially \nexploit this to bypass security checks. (CVE-2019-9816)\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-06-14T00:00:00", "type": "ubuntu", "title": "Firefox regression", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-06-14T00:00:00", "id": "USN-3991-3", "href": "https://ubuntu.com/security/notices/USN-3991-3", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2021-07-28T14:34:01", "description": "Arch Linux Security Advisory ASA-201905-9\n=========================================\n\nSeverity: Critical\nDate : 2019-05-23\nCVE-ID : CVE-2019-7317 CVE-2019-9800 CVE-2019-9814 CVE-2019-9816\nCVE-2019-9817 CVE-2019-9819 CVE-2019-9820 CVE-2019-9821\nCVE-2019-11691 CVE-2019-11692 CVE-2019-11693 CVE-2019-11695\nCVE-2019-11696 CVE-2019-11697 CVE-2019-11698 CVE-2019-11699\nCVE-2019-11701\nPackage : firefox\nType : multiple issues\nRemote : Yes\nLink : https://security.archlinux.org/AVG-966\n\nSummary\n=======\n\nThe package firefox before version 67.0-1 is vulnerable to multiple\nissues including arbitrary code execution, access restriction bypass,\nsame-origin policy bypass, content spoofing, information disclosure,\ncross-site scripting and denial of service.\n\nResolution\n==========\n\nUpgrade to 67.0-1.\n\n# pacman -Syu \"firefox>=67.0-1\"\n\nThe problems have been fixed upstream in version 67.0.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\n- CVE-2019-7317 (denial of service)\n\npng_image_free in png.c in libpng 1.6.36 has a use-after-free because\npng_image_free_function is called under png_safe_execute.\n\n- CVE-2019-9800 (arbitrary code execution)\n\nSeveral memory safety bugs have been found in Firefox before 67.0 and\nThunderbird before 60.7.0. Some of these bugs showed evidence of memory\ncorruption and Mozilla presumes that with enough effort some of these\ncould be exploited to run arbitrary code.\n\n- CVE-2019-9814 (arbitrary code execution)\n\nSeveral memory safety bugs have been found in Firefox before 67.0. Some\nof these bugs showed evidence of memory corruption and Mozilla presumes\nthat with enough effort some of these could be exploited to run\narbitrary code.\n\n- CVE-2019-9816 (access restriction bypass)\n\nA possible vulnerability exists in Firefox before 67.0 and Thunderbird\nbefore 60.7.0, where type confusion can occur when manipulating\nJavaScript objects in object groups, allowing for the bypassing of\nsecurity checks within these groups. Note that this vulnerability has\nonly been demonstrated with UnboxedObjects, which are disabled by\ndefault on all supported releases.\n\n- CVE-2019-9817 (same-origin policy bypass)\n\nIn Firefox before 67.0 and Thunderbird before 60.7.0, images from a\ndifferent domain can be read using a canvas object in some\ncircumstances. This could be used to steal image data from a different\nsite in violation of same-origin policy.\n\n- CVE-2019-9819 (arbitrary code execution)\n\nA vulnerability where a JavaScript compartment mismatch can occur in\nFirefox before 67.0 and Thunderbird before 60.7.0, while working with\nthe fetch API, resulting in a potentially exploitable crash.\n\n- CVE-2019-9820 (arbitrary code execution)\n\nA use-after-free vulnerability can occur in the chrome event handler of\nFirefox before 67.0 when it is freed while still in use. This results\nin a potentially exploitable crash.\n\n- CVE-2019-9821 (arbitrary code execution)\n\nA use-after-free vulnerability can occur in AssertWorkerThread in\nFirefox before 67.0, due to a race condition with shared workers. This\nresults in a potentially exploitable crash.\n\n- CVE-2019-11691 (arbitrary code execution)\n\nA use-after-free vulnerability can occur in Firefox before 67.0 and\nThunderbird before 60.7.0, when working with XMLHttpRequest (XHR) in an\nevent loop, causing the XHR main thread to be called after it has been\nfreed. This results in a potentially exploitable crash.\n\n- CVE-2019-11692 (arbitrary code execution)\n\nA use-after-free vulnerability can occur in Firefox before 67.0 and\nThunderbird before 60.7.0, when listeners are removed from the event\nlistener manager while still in use, resulting in a potentially\nexploitable crash.\n\n- CVE-2019-11693 (arbitrary code execution)\n\nThe bufferdata function in WebGL in Firefox before 67.0 and Thunderbird\nbefore 60.7.0 is vulnerable to a buffer overflow with specific graphics\ndrivers on Linux. This could result in malicious content freezing a tab\nor triggering a potentially exploitable crash.\n\n- CVE-2019-11695 (content spoofing)\n\nIn Firefox before 67.0, a custom cursor defined by scripting on a site\ncan position itself over the addressbar to spoof the actual cursor when\nit should not be allowed outside of the primary web content area. This\ncould be used by a malicious site to trick users into clicking on\npermission prompts, doorhanger notifications, or other buttons\ninadvertently if the location is spoofed over the user interface.\n\n- CVE-2019-11696 (content spoofing)\n\nIn Firefox before 67.0, files with the .JNLP extension used for \"Java\nweb start\" applications are not treated as executable content for\ndownload prompts even though they can be executed if Java is installed\non the local system. This could allow users to mistakenly launch an\nexecutable binary locally.\n\n- CVE-2019-11697 (access restriction bypass)\n\nIn Firefox before 67.0, if the ALT and \"a\" keys are pressed when users\nreceive an extension installation prompt, the extension will be\ninstalled without the install prompt delay that keeps the prompt\nvisible in order for users to accept or decline the installation. A\nmalicious web page could use this with spoofing on the page to trick\nusers into installing a malicious extension.\n\n- CVE-2019-11698 (information disclosure)\n\nIf a crafted hyperlink is dragged and dropped to the bookmark bar or\nsidebar in Firefox before 67.0 or Thunderbird before 60.7.0, and the\nresulting bookmark is subsequently dragged and dropped into the web\ncontent area, an arbitrary query of a user's browser history can be run\nand transmitted to the content page via drop event data. This allows\nfor the theft of browser history by a malicious site.\n\n- CVE-2019-11699 (content spoofing)\n\nA malicious page can briefly cause the wrong name to be highlighted as\nthe domain name in the addressbar during page navigations in Firefox\nbefore 67.0. This could result in user confusion of which site is\ncurrently loaded for spoofing attacks.\n\n- CVE-2019-11701 (cross-site scripting)\n\nThe default webcal: protocol handler in Firefox before 67.0 will load a\nweb site vulnerable to cross-site scripting (XSS) attacks. This default\nwas left in place as a legacy feature and has now been removed.\n\nImpact\n======\n\nA remote attacker can crash the browser, access sensitive information,\nbypass security measures or execute arbitrary code on the affected\nhost.\n\nReferences\n==========\n\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/\nhttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12803\nhttps://github.com/glennrp/libpng/issues/275\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9800\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1540166%2C1534593%2C1546327%2C1540136%2C1538736%2C1538042%2C1535612%2C1499719%2C1499108%2C1538619%2C1535194%2C1516325%2C1542324%2C1542097%2C1532465%2C1533554%2C1541580\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9814\nhttps://bugzilla.mozilla.org/buglist.cgi?bug_id=1527592%2C1534536%2C1520132%2C1543159%2C1539393%2C1459932%2C1459182%2C1516425\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9816\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-9816\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1536768\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9817\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-9817\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1540221\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9819\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-9819\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1532553\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9820\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1536405\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-9821\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1539125\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11691\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-11691\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1542465\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11692\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-11692\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1544670\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11693\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-11693\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1532525\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11695\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1445844\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11696\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1392955\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11697\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1440079\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11698\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-15/#CVE-2019-11698\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1543191\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11699\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1528939\nhttps://www.mozilla.org/en-US/security/advisories/mfsa2019-13/#CVE-2019-11701\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=1518627\nhttps://security.archlinux.org/CVE-2019-7317\nhttps://security.archlinux.org/CVE-2019-9800\nhttps://security.archlinux.org/CVE-2019-9814\nhttps://security.archlinux.org/CVE-2019-9816\nhttps://security.archlinux.org/CVE-2019-9817\nhttps://security.archlinux.org/CVE-2019-9819\nhttps://security.archlinux.org/CVE-2019-9820\nhttps://security.archlinux.org/CVE-2019-9821\nhttps://security.archlinux.org/CVE-2019-11691\nhttps://security.archlinux.org/CVE-2019-11692\nhttps://security.archlinux.org/CVE-2019-11693\nhttps://security.archlinux.org/CVE-2019-11695\nhttps://security.archlinux.org/CVE-2019-11696\nhttps://security.archlinux.org/CVE-2019-11697\nhttps://security.archlinux.org/CVE-2019-11698\nhttps://security.archlinux.org/CVE-2019-11699\nhttps://security.archlinux.org/CVE-2019-11701", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-05-23T00:00:00", "type": "archlinux", "title": "[ASA-201905-9] firefox: multiple issues", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-05-23T00:00:00", "id": "ASA-201905-9", "href": "https://security.archlinux.org/ASA-201905-9", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "kaspersky": [{"lastseen": "2023-02-08T15:58:30", "description": "### *Detect date*:\n05/21/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, cause denial of service, spoof user interface, perform cross-site scripting attack, execute arbitrary code.\n\n### *Affected products*:\nMozilla Firefox earlier than 67\n\n### *Solution*:\nUpdate to the latest version\n\n### *Original advisories*:\n[mfsa2019-13](<https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Mozilla Firefox](<https://threats.kaspersky.com/en/product/Mozilla-Firefox/>)\n\n### *CVE-IDS*:\n[CVE-2019-9816](<https://vulners.com/cve/CVE-2019-9816>)4.3Warning \n[CVE-2019-9817](<https://vulners.com/cve/CVE-2019-9817>)5.0Critical \n[CVE-2019-9818](<https://vulners.com/cve/CVE-2019-9818>)5.1High \n[CVE-2019-9819](<https://vulners.com/cve/CVE-2019-9819>)7.5Critical \n[CVE-2019-9820](<https://vulners.com/cve/CVE-2019-9820>)7.5Critical \n[CVE-2019-9821](<https://vulners.com/cve/CVE-2019-9821>)6.8High \n[CVE-2019-11691](<https://vulners.com/cve/CVE-2019-11691>)7.5Critical \n[CVE-2019-11692](<https://vulners.com/cve/CVE-2019-11692>)7.5Critical \n[CVE-2019-7317](<https://vulners.com/cve/CVE-2019-7317>)2.6Warning \n[CVE-2019-11694](<https://vulners.com/cve/CVE-2019-11694>)5.0Critical \n[CVE-2019-11695](<https://vulners.com/cve/CVE-2019-11695>)4.3Warning \n[CVE-2019-11696](<https://vulners.com/cve/CVE-2019-11696>)6.8High \n[CVE-2019-11697](<https://vulners.com/cve/CVE-2019-11697>)4.3Warning \n[CVE-2019-11698](<https://vulners.com/cve/CVE-2019-11698>)5.0Critical \n[CVE-2019-11700](<https://vulners.com/cve/CVE-2019-11700>)4.3Warning \n[CVE-2019-11699](<https://vulners.com/cve/CVE-2019-11699>)4.3Warning \n[CVE-2019-11701](<https://vulners.com/cve/CVE-2019-11701>)4.3Warning \n[CVE-2019-9814](<https://vulners.com/cve/CVE-2019-9814>)7.5Critical \n[CVE-2019-9800](<https://vulners.com/cve/CVE-2019-9800>)7.5Critical \n[CVE-2019-9815](<https://vulners.com/cve/CVE-2019-9815>)6.8High \n[CVE-2019-11693](<https://vulners.com/cve/CVE-2019-11693>)7.5Critical", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-05-21T00:00:00", "type": "kaspersky", "title": "KLA11486 Multiple vulnerabilities in Mozilla Firefox", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11694", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11700", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9815", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9818", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2020-06-03T00:00:00", "id": "KLA11486", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11486/", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "freebsd": [{"lastseen": "2022-01-19T15:51:31", "description": "\n\nMozilla Foundation reports:\n\nCVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS\nCVE-2019-9816: Type confusion with object groups and UnboxedObjects\nCVE-2019-9817: Stealing of cross-domain images using canvas\nCVE-2019-9818: Use-after-free in crash generation server\nCVE-2019-9819: Compartment mismatch with fetch API\nCVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell\nCVE-2019-9821: Use-after-free in AssertWorkerThread\nCVE-2019-11691: Use-after-free in XMLHttpRequest\nCVE-2019-11692: Use-after-free removing listeners in the event listener manager\nCVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux\nCVE-2019-7317: Use-after-free in png_image_free of libpng library\nCVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox\nCVE-2019-11695: Custom cursor can render over user interface outside of web content\nCVE-2019-11696: Java web start .JNLP files are not recognized as executable files for download prompts\nCVE-2019-11697: Pressing key combinations can bypass installation prompt delays and install extensions\nCVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks\nCVE-2019-11700: res: protocol can be used to open known local files\nCVE-2019-11699: Incorrect domain name highlighting during page navigation\nCVE-2019-11701: webcal: protocol default handler loads vulnerable web page\nCVE-2019-9814: Memory safety bugs fixed in Firefox 67\nCVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7\n\n\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-05-21T00:00:00", "type": "freebsd", "title": "mozilla -- multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11691", "CVE-2019-11692", "CVE-2019-11693", "CVE-2019-11694", "CVE-2019-11695", "CVE-2019-11696", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-11699", "CVE-2019-11700", "CVE-2019-11701", "CVE-2019-7317", "CVE-2019-9800", "CVE-2019-9814", "CVE-2019-9815", "CVE-2019-9816", "CVE-2019-9817", "CVE-2019-9818", "CVE-2019-9819", "CVE-2019-9820", "CVE-2019-9821"], "modified": "2019-07-23T00:00:00", "id": "44B6DFBF-4EF7-4D52-AD52-2B1B05D81272", "href": "https://vuxml.freebsd.org/freebsd/44b6dfbf-4ef7-4d52-ad52-2b1b05d81272.html", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "mozilla": [{"lastseen": "2021-12-29T14:11:53", "description": "If hyperthreading is not disabled, a timing attack vulnerability exists, similar to previous Spectre attacks. Apple has shipped macOS 10.14.5 with an option to disable hyperthreading in applications running untrusted code in a thread through a new sysctl. Firefox now makes use of it on the main thread and any worker threads. Note: users need to update to macOS 10.14.5 in order to take advantage of this change.\nA possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.\nImages from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy.\nA race condition is present in the crash generation server used to generate data for the crash reporter. This issue can lead to a use-after-free in the main process, resulting in a potentially exploitable crash and a sandbox escape. Note: this vulnerability only affects Windows. Other operating systems are unaffected.\nA vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash.\nA use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. \nA use-after-free vulnerability can occur in AssertWorkerThread due to a race condition with shared workers. This results in a potentially exploitable crash.\nA use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. \nA use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash.\nThe bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. Note: this issue only occurs on Linux. Other operating systems are unaffected.\nA use-after-free vulnerability was discovered in the png_image_free function in the libpng library. This could lead to denial of service or a potentially exploitable crash when a malformed image is processed.\nA vulnerability exists in the Windows sandbox where an uninitialized value in memory can be leaked to a renderer from a broker when making a call to access an otherwise unavailable file. This results in the potential leaking of information stored at that memory location. Note: this issue only occurs on Windows. Other operating systems are unaffected.\nA custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger notifications, or other buttons inadvertently if the location is spoofed over the user interface.\nFiles with the .JNLP extension used for \"Java web start\" applications are not treated as executable content for download prompts even though they can be executed if Java is installed on the local system. This could allow users to mistakenly launch an executable binary locally.\nIf the ALT and \"a\" keys are pressed when users receive an extension installation prompt, the extension will be installed without the install prompt delay that keeps the prompt visible in order for users to accept or decline the installation. A malicious web page could use this with spoofing on the page to trick users into installing a malicious extension.\nIf a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. \nA hyperlink using the res: protocol can be used to open local files at a known location in Internet Explorer if a user approves execution when prompted. Note: this issue only occurs on Windows. Other operating systems are unaffected.\nA malicious page can briefly cause the wrong name to be highlighted as the domain name in the addressbar during page navigations. This could result in user confusion of which site is currently loaded for spoofing attacks.\nThe default webcal: protocol handler will load a web site vulnerable to cross-site scripting (XSS) attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.\nMozilla developers and community members Christian Holler, Andrei Ciure, Julien Cristau, Jan de Mooij, Jan Varga, Marcia Knous, Andr\u00e9 Bargull, and Philipp reported memory safety bugs present in Firefox 66. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.\nMozilla developers and community members Olli Pettay, Bogdan Tara, Jan de Mooij, Jason Kratzer, Jan Varga, Gary Kwong, Tim Guan-tin Chien, Tyson Smith, Ronald Crane, and Ted Campbell reported memory safety bugs present in Firefox 66 and Firefox ESR 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.\n", "edition": 1, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2019-05-21T00:00:00", "type": "mozilla", "title": "Security vulnerabilities fixed in Firefox 67 \u2014 Mozilla", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-11692", "CVE-2019-11694", "CVE-2019-11696", "CVE-2019-7317", "CVE-2019-11700", "CVE-2019-9817", "CVE-2019-11699", "CVE-2019-11693", "CVE-2019-9814", "CVE-2019-11697", "CVE-2019-11698", "CVE-2019-9819", "CVE-2019-9800", "CVE-2019-9820", "CVE-2019-9821", "CVE-2019-11701", "CVE-2019-9816", "CVE-2019-11691", "CVE-2019-9815", "CVE-2019-9818", "CVE-2019-11695"], "modified": "2019-05-21T00:00:00", "id": "MFSA2019-13", "href": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-13/", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
CVE-2019-11697
