Lucene search

K
mageiaGentoo FoundationMGASA-2019-0213
HistoryJul 21, 2019 - 9:17 p.m.

Updated firefox packages fix security vulnerability

2019-07-2121:17:27
Gentoo Foundation
advisories.mageia.org
29

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.722 High

EPSS

Percentile

98.0%

Sandbox escape via installation of malicious language pack. (CVE-2019-9811) Script injection within domain through inner window reuse. (CVE-2019-11711) Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects. (CVE-2019-11712) Use-after-free with HTTP/2 cached stream. (CVE-2019-11713) NeckoChild can trigger crash when accessed off of main thread. (CVE-2019-11714) Empty or malformed p256-ECDH public keys may trigger a segmentation fault. (CVE-2019-11729) HTML parsing error can contribute to content XSS. (CVE-2019-11715) globalThis not enumerable until accessed. (CVE-2019-11716) Caret character improperly escaped in origins. (CVE-2019-11717) Activity Stream writes unsanitized content to innerHTML. (CVE-2019-11718) Out-of-bounds read when importing curve25519 private key. (CVE-2019-11719) Character encoding XSS vulnerability. (CVE-2019-11720) Domain spoofing through unicode latin ‘kra’ character. (CVE-2019-11721) Same-origin policy treats all files in a directory as having the same-origin. (CVE-2019-11730) Cookie leakage during add-on fetching across private browsing boundaries. (CVE-2019-11723) Retired site input.mozilla.org has remote troubleshooting permissions. (CVE-2019-11724) Websocket resources bypass safebrowsing protections. (CVE-2019-11725) PKCS#1 v1.5 signatures can be used for TLS 1.3. (CVE-2019-11727) Port scanning through Alt-Svc header. (CVE-2019-11728) Memory safety bugs fixed in Firefox 68. (CVE-2019-11710) Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8. (CVE-2019-11709)

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.722 High

EPSS

Percentile

98.0%