1. Server >
  2. Unix Server >
  3. USN-3544-1: Firefox vulnerabilities


ArabicEnglishFrenchGermanGreekItalianJapaneseKoreanPersianPolishPortugueseRussianSpanishTurkishVietnamese

USN-3544-1: Firefox vulnerabilities

RSS Kategorie Pfeil Unix Server vom | Quelle: ubuntu.com Direktlink öffnen

Ubuntu Security Notice USN-3544-1

24th January, 2018

firefox vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Software description

  • firefox - Mozilla Open Source web browser

Details

Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, spoof the origin in audio capture prompts, trick the user in to
providing HTTP credentials for another origin, spoof the addressbar
contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090,
CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095,
CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101,
CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109, CVE-2018-5114,
CVE-2018-5115, CVE-2018-5117, CVE-2018-5122)

Multiple security issues were discovered in WebExtensions. If a user were
tricked in to installing a specially crafted extension, an attacker could
potentially exploit these to gain additional privileges, bypass
same-origin restrictions, or execute arbitrary code. (CVE-2018-5105,
CVE-2018-5113, CVE-2018-5116)

A security issue was discovered with the developer tools. If a user were
tricked in to opening a specially crafted website with the developer tools
open, an attacker could potentially exploit this to obtain sensitive
information from other origins. (CVE-2018-5106)

A security issue was discovered with printing. An attacker could
potentially exploit this to obtain sensitive information from local files.
(CVE-2018-5107)

It was discovered that manually entered blob URLs could be accessed by
subsequent private browsing tabs. If a user were tricked in to entering
a blob URL, an attacker could potentially exploit this to obtain sensitive
information from a private browsing context. (CVE-2018-5108)

It was discovered that dragging certain specially formatted URLs to the
addressbar could cause the wrong URL to be displayed. If a user were
tricked in to opening a specially crafted website and dragging a URL to
the addressbar, an attacker could potentially exploit this to spoof the
addressbar contents. (CVE-2018-5111)

It was discovered that WebExtension developer tools panels could open
non-relative URLs. If a user were tricked in to installing a specially
crafted extension and running the developer tools, an attacker could
potentially exploit this to gain additional privileges. (CVE-2018-5112)

It was discovered that ActivityStream images can attempt to load local
content through file: URLs. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this in
combination with another vulnerability that allowed sandbox protections to
be bypassed, in order to obtain sensitive information from local files.
(CVE-2018-5118)

It was discovered that the reader view will load cross-origin content in
violation of CORS headers. An attacker could exploit this to bypass CORS
restrictions. (CVE-2018-5119)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.10:
firefox 58.0+build6-0ubuntu0.17.10.1
Ubuntu 16.04 LTS:
firefox 58.0+build6-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
firefox 58.0+build6-0ubuntu0.14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

CVE-2018-5089, CVE-2018-5090, CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5105, CVE-2018-5106, CVE-2018-5107, CVE-2018-5108, CVE-2018-5109, CVE-2018-5111, CVE-2018-5112, CVE-2018-5113, CVE-2018-5114, CVE-2018-5115, CVE-2018-5116, CVE-2018-5117, CVE-2018-5118, CVE-2018-5119, CVE-2018-5122

...

Webseite öffnen Komplette Webseite öffnen

Newsbewertung

Kommentiere zu USN-3544-1: Firefox vulnerabilities






Ähnliche Beiträge

  • 1. r/linux Discusses: Web Browsers and You - How to protect yourself online and bring about a free and open web vom 150.82 Punkte ic_school_black_18dp
    Google, who makes their money from Ads, is planning to remove a key component that allows adblocking to be effective in Google Chrome standard edition. While there will still be adblockers on the Chrome/Blink platform they will not work as well as othe
  • 2. USN-3544-2: Firefox regressions vom 130.52 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3544-2 12th February, 2018 firefox regressions A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 17.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Summary USN-3544-1 caused some regressions
  • 3. USN-2917-2: Firefox regressions vom 126.36 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2917-2 7th April, 2016 firefox regressions A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-2917-1 introduced several regressions in Fir
  • 4. USN-2917-2: Firefox regressions vom 126.36 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2917-2 7th April, 2016 firefox regressions A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-2917-1 introduced several regressions in Fir
  • 5. USN-2917-2: Firefox regressions vom 126.36 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2917-2 7th April, 2016 firefox regressions A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-2917-1 introduced several regressions in Fir
  • 6. USN-2917-3: Firefox regressions vom 126.36 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2917-3 19th April, 2016 firefox regressions A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-2917-1 introduced several regressions in Fir
  • 7. USN-2917-1: Firefox vulnerabilities vom 111.07 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2917-1 9th March, 2016 firefox vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary Firefox could be made to crash or r
  • 8. USN-2833-1: Firefox vulnerabilities vom 103.71 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2833-1 15th December, 2015 firefox vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 15.04 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary Firefox could
  • 9. USN-2936-3: Firefox regression vom 100.61 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2936-3 18th May, 2016 firefox regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.04 LTS Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-2936-1 introduced a re
  • 10. USN-2880-2: Firefox regression vom 95.52 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-2880-2 8th February, 2016 firefox regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 15.10 Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-2880-1 introduced a regression in
  • 11. USN-3275-2: OpenJDK 7 vulnerabilities vom 90.35 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3275-2 15th May, 2017 openjdk-7 vulnerabilities A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 14.04 LTS Summary Several security issues were fixed in OpenJDK 7. Software description openj
  • 12. USN-3175-2: Firefox regression vom 89.58 Punkte ic_school_black_18dp
    Ubuntu Security Notice USN-3175-2 6th February, 2017 firefox regression A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 16.10 Ubuntu 16.04 LTS Ubuntu 14.04 LTS Ubuntu 12.04 LTS Summary USN-3175-1 intr