Lucene search

K
ubuntucveUbuntu.comUB:CVE-2019-17022
HistoryJan 08, 2020 - 12:00 a.m.

CVE-2019-17022

2020-01-0800:00:00
ubuntu.com
ubuntu.com
21

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

64.5%

When pasting a <style> tag from the clipboard into a rich text
editor, the CSS sanitizer does not escape < and > characters. Because
the resulting string is pasted directly into the text node of the element
this does not result in a direct injection into the webpage; however, if a
webpage subsequently copies the node’s innerHTML, assigning it to another
innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors
were identified with this behavior, more may exist. This vulnerability
affects Firefox ESR < 68.4 and Firefox < 72.

Notes

Author Note
tyhicks mozjs contains a copy of the SpiderMonkey JavaScript engine
OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchfirefox< 72.0.1+build1-0ubuntu0.18.04.1UNKNOWN
ubuntu19.04noarchfirefox< 72.0.1+build1-0ubuntu0.19.04.1UNKNOWN
ubuntu19.10noarchfirefox< 72.0.1+build1-0ubuntu0.19.10.1UNKNOWN
ubuntu20.04noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
ubuntu20.10noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
ubuntu21.04noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
ubuntu21.10noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
ubuntu22.04noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
ubuntu22.10noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
ubuntu23.04noarchfirefox< 72.0.1+build1-0ubuntu1UNKNOWN
Rows per page:
1-10 of 281

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

64.5%