Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, cross-site scripting, bypass of the same-origin policy, sandbox escape, information disclosure or denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 60.9.0esr-1~deb8u1.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-26 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-26 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 60.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-27 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox to 68.1 fixes the following issues :

Security issues fixed :

  - CVE-2019-9811: Fixed a sandbox escape via installation     of malicious language pack. (bsc#1140868)

  - CVE-2019-9812: Fixed a sandbox escape through Firefox     Sync. (bsc#1149294)

  - CVE-2019-11710: Fixed several memory safety bugs.
    (bsc#1140868)

  - CVE-2019-11714: Fixed a potentially exploitable crash in     Necko. (bsc#1140868)

  - CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)

  - CVE-2019-11718: Fixed inadequate sanitation in the     Activity Stream component. (bsc#1140868)

  - CVE-2019-11720: Fixed a character encoding XSS     vulnerability. (bsc#1140868)

  - CVE-2019-11721: Fixed a homograph domain spoofing issue     through unicode latin 'kra' character. (bsc#1140868)

  - CVE-2019-11723: Fixed a cookie leakage during add-on     fetching across private browsing boundaries.
    (bsc#1140868)

  - CVE-2019-11724: Fixed an outdated permission, granting     access to retired site input.mozilla.org. (bsc#1140868)

  - CVE-2019-11725: Fixed a Safebrowsing bypass involving     WebSockets. (bsc#1140868)

  - CVE-2019-11727: Fixed a vulnerability where it possible     to force NSS to sign CertificateVerify with PKCS#1 v1.5     signatures when those are the only ones advertised by     server in CertificateRequest in TLS 1.3. (bsc#1141322)

  - CVE-2019-11728: Fixed an improper handling of the     Alt-Svc header that allowed remote port scans.
    (bsc#1140868)

  - CVE-2019-11733: Fixed an insufficient protection of     stored passwords in 'Saved Logins'. (bnc#1145665)

  - CVE-2019-11735: Fixed several memory safety bugs.
    (bnc#1149293)

  - CVE-2019-11736: Fixed a file manipulation and privilege     escalation in Mozilla Maintenance Service. (bnc#1149292) 

  - CVE-2019-11738: Fixed a content security policy bypass     through hash-based sources in directives. (bnc#1149302)

  - CVE-2019-11740: Fixed several memory safety bugs.
    (bsc#1149299)

  - CVE-2019-11742: Fixed a same-origin policy violation     involving SVG filters and canvas to steal cross-origin     images. (bsc#1149303)

  - CVE-2019-11743: Fixed a timing side-channel attack on     cross-origin information, utilizing unload event     attributes. (bsc#1149298)

  - CVE-2019-11744: Fixed an XSS caused by breaking out of     title and textarea elements using innerHTML.
    (bsc#1149304)

  - CVE-2019-11746: Fixed a use-after-free while     manipulating video. (bsc#1149297)

  - CVE-2019-11752: Fixed a use-after-free while extracting     a key value in IndexedDB. (bsc#1149296)

  - CVE-2019-11753: Fixed a privilege escalation with     Mozilla Maintenance Service in custom Firefox     installation location. (bsc#1149295)

Non-security issues fixed :

&#9; - Latest update now also released for s390x. (bsc#1109465)

  - Fixed a segmentation fault on s390vsl082. (bsc#1117473)

  - Fixed a crash on SLES15 s390x. (bsc#1124525)

  - Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Published	Updated	Severity
128555	Debian DLA-1910-1 : firefox-esr security update	Nessus	Debian Local Security Checks	9/9/2019	4/29/2024	critical
128527	Mozilla Firefox ESR < 68.1	Nessus	MacOS X Local Security Checks	9/5/2019	4/29/2024	critical
128528	Mozilla Firefox ESR < 68.1	Nessus	Windows	9/5/2019	4/29/2024	critical
128530	Mozilla Firefox ESR < 60.9	Nessus	Windows	9/5/2019	4/29/2024	critical
129664	openSUSE Security Update : MozillaFirefox (openSUSE-2019-2251)	Nessus	SuSE Local Security Checks	10/7/2019	4/19/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical