logo
 
  1. Server >
  2. Unix Server >
  3. USN-3544-1: Firefox vulnerabilities


ArabicEnglishFrenchGermanGreekItalianJapaneseKoreanPersianPolishPortugueseRussianSpanishTurkishVietnamese

USN-3544-1: Firefox vulnerabilities

Unix Server vom | Direktlink: ubuntu.com Nachrichten Bewertung

Ubuntu Security Notice USN-3544-1

24th January, 2018

firefox vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 17.10
  • Ubuntu 16.04 LTS
  • Ubuntu 14.04 LTS

Summary

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Software description

  • firefox - Mozilla Open Source web browser

Details

Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, spoof the origin in audio capture prompts, trick the user in to
providing HTTP credentials for another origin, spoof the addressbar
contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090,
CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095,
CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101,
CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109, CVE-2018-5114,
CVE-2018-5115, CVE-2018-5117, CVE-2018-5122)

Multiple security issues were discovered in WebExtensions. If a user were
tricked in to installing a specially crafted extension, an attacker could
potentially exploit these to gain additional privileges, bypass
same-origin restrictions, or execute arbitrary code. (CVE-2018-5105,
CVE-2018-5113, CVE-2018-5116)

A security issue was discovered with the developer tools. If a user were
tricked in to opening a specially crafted website with the developer tools
open, an attacker could potentially exploit this to obtain sensitive
information from other origins. (CVE-2018-5106)

A security issue was discovered with printing. An attacker could
potentially exploit this to obtain sensitive information from local files.
(CVE-2018-5107)

It was discovered that manually entered blob URLs could be accessed by
subsequent private browsing tabs. If a user were tricked in to entering
a blob URL, an attacker could potentially exploit this to obtain sensitive
information from a private browsing context. (CVE-2018-5108)

It was discovered that dragging certain specially formatted URLs to the
addressbar could cause the wrong URL to be displayed. If a user were
tricked in to opening a specially crafted website and dragging a URL to
the addressbar, an attacker could potentially exploit this to spoof the
addressbar contents. (CVE-2018-5111)

It was discovered that WebExtension developer tools panels could open
non-relative URLs. If a user were tricked in to installing a specially
crafted extension and running the developer tools, an attacker could
potentially exploit this to gain additional privileges. (CVE-2018-5112)

It was discovered that ActivityStream images can attempt to load local
content through file: URLs. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this in
combination with another vulnerability that allowed sandbox protections to
be bypassed, in order to obtain sensitive information from local files.
(CVE-2018-5118)

It was discovered that the reader view will load cross-origin content in
violation of CORS headers. An attacker could exploit this to bypass CORS
restrictions. (CVE-2018-5119)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 17.10:
firefox 58.0+build6-0ubuntu0.17.10.1
Ubuntu 16.04 LTS:
firefox 58.0+build6-0ubuntu0.16.04.1
Ubuntu 14.04 LTS:
firefox 58.0+build6-0ubuntu0.14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

CVE-2018-5089, CVE-2018-5090, CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5105, CVE-2018-5106, CVE-2018-5107, CVE-2018-5108, CVE-2018-5109, CVE-2018-5111, CVE-2018-5112, CVE-2018-5113, CVE-2018-5114, CVE-2018-5115, CVE-2018-5116, CVE-2018-5117, CVE-2018-5118, CVE-2018-5119, CVE-2018-5122

...

Externe Webseite mit kompletten Inhalt öffnen

Kommentiere zu USN-3544-1: Firefox vulnerabilities






➤ Ähnliche Beiträge

  • 1.

    [Stable Update] 2019-10-14 - Pamac 9.0, LLVM9, Firefox, KDE Apps 19.08.2

    vom 679.72 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Stable Update. Mostly we have updates for our second release candidate of Manjaro 18.1.1. EEblKiqWsAAsjcw?format=jpg&name=large1220×882Pamac 9.0 with Snap
  • 2.

    [Testing Update] 2019-10-13 - Kernels, KDE Apps, Firefox, LLVM9, Pamac 9.0

    vom 679.72 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have updates for our second release candidate of Manjaro 18.1.1. EEblKiqWsAAsjcw?format=jpg&name=large1220×882Pamac 9.0 with Snap
  • 3.

    [Stable Update] 2019-11-05 - Kernels, Plasma, Firefox, Toolchain

    vom 679.72 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Stable Update. EIXU5J4WkAIpOAw?format=jpg&name=small680×510 With this we have rebuilt most of our Kernels with extramodules and ship the latest packages of KDE
  • 4.

    [Testing Update] 2019-10-31 - KDE-Plasma, Kernels, Palemoon

    vom 676.14 Punkte ic_school_black_18dp
    @oberon wrote: Hello community, I am happy to announce another Testing Update. image.jpg612×598 72.3 KB With this we have rebuilt most of our kernels with extramodules and ship the latest packages of KDE-Plasma 5.17.2 If you like f
  • 5.

    [Testing Update] 2019-10-04 - Gnome-Keyring, Budgie, Firefox

    vom 350.59 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have updates to Gnome-Keyring, Firefox and Budgie. repo-compare is one of our new web-services. Give us your feedback on that new service! Up
  • 6.

    [Testing Update] 2019-09-28 - Realtime-Kernel, Mesa 19.2.0, Firefox-Dev, ZFS

    vom 343.44 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have Mesa 19.2, updated Realtime-Kernel and the usual rebuilds. Mesa 19.2 series added Navi-Support. More details here Update news This update
  • 7.

    [Testing Update] 2019-10-27 - KDE-Git, Nvidia, Xorg-Server

    vom 343.44 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have updates for Pacman 5.2 release. Tell us about the default layout we should use for Gnome Update news This update holds the following chan
  • 8.

    [Testing Update] 2019-11-12 - Nvidia, Plasma, Firefox-Dev

    vom 343.44 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. 1280×720Checkout our latest Pinebook Pro Preview featuring the mainline kernel With this we have new Nvidia drivers, latest KDE Frameworks. Some feature
  • 9.

    [Testing Update] 2019-09-25 - Pamac, Brave, Gstreamer, Bluez

    vom 339.86 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have Kernels, Gnome 3.34 and needed rebuilds with this one. EEblKiiWwAIX7q9?format=jpg&name=large1220×882Help us to debug pamac
  • 10.

    [Testing Update] 2019-11-11 - Kernels, KDE Frameworks, Nvidia, Brave

    vom 339.86 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Checkout our latest server holding the latest KDE-git packages With this we have new Nvidia drivers, latest KDE Frameworks. Some feature-updates: KDE Frameworks are at 5.64.0 Bra
  • 11.

    [Testing Update] 2019-10-09 - Pamac 9.0-rc4-3, Gnome-Shell 3.34.1, Nvidia

    vom 336.28 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have updates for our release candidate of Manjaro 18.1.1. Tell us if we still miss some in 18.1.1-rc1! Update news This update holds th
  • 12.

    [Testing Update] 2019-10-02 - Manjaro 18.1.1-pre2, Kernels, Repo-Compare, Pamac 9.0-RC3

    vom 336.28 Punkte ic_school_black_18dp
    @philm wrote: Hello community, I am happy to announce another Testing Update. Mostly we have Manjaro 18.1.1-pre2, fixed Pamac 9.0 AUR issues and the usual upstream updates. repo-compare is one of our new web-services. Give u