This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============2524718601751121538== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="pn7WMiqlwzzyWuw0zUbMZqsvd0OQHl6an"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pn7WMiqlwzzyWuw0zUbMZqsvd0OQHl6an Content-Type: multipart/mixed; boundary="FubxZSknefpQse1Dq4fK3eVAFJhxSXF6s"; protected-headers="v1" From: Chris Coulson <chris.coulson@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <681973eb-e755-545a-3057-efa9ec62cd4e@canonical.com> Subject: [USN-3544-1] Firefox vulnerabilities
--FubxZSknefpQse1Dq4fK3eVAFJhxSXF6s Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable Content-Language: en-US
========================================================================== Ubuntu Security Notice USN-3544-1 January 24, 2018
firefox vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 17.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS
Summary:
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Software Description: - firefox: Mozilla Open Source web browser
Details:
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, spoof the origin in audio capture prompts, trick the user in to providing HTTP credentials for another origin, spoof the addressbar contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090, CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109, CVE-2018-5114, CVE-2018-5115, CVE-2018-5117, CVE-2018-5122)
Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to gain additional privileges, bypass same-origin restrictions, or execute arbitrary code. (CVE-2018-5105, CVE-2018-5113, CVE-2018-5116)
A security issue was discovered with the developer tools. If a user were tricked in to opening a specially crafted website with the developer tools open, an attacker could potentially exploit this to obtain sensitive information from other origins. (CVE-2018-5106)
A security issue was discovered with printing. An attacker could potentially exploit this to obtain sensitive information from local files. (CVE-2018-5107)
It was discovered that manually entered blob URLs could be accessed by subsequent private browsing tabs. If a user were tricked in to entering a blob URL, an attacker could potentially exploit this to obtain sensitive information from a private browsing context. (CVE-2018-5108)
It was discovered that dragging certain specially formatted URLs to the addressbar could cause the wrong URL to be displayed. If a user were tricked in to opening a specially crafted website and dragging a URL to the addressbar, an attacker could potentially exploit this to spoof the addressbar contents. (CVE-2018-5111)
It was discovered that WebExtension developer tools panels could open non-relative URLs. If a user were tricked in to installing a specially crafted extension and running the developer tools, an attacker could potentially exploit this to gain additional privileges. (CVE-2018-5112)
It was discovered that ActivityStream images can attempt to load local content through file: URLs. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another vulnerability that allowed sandbox protections to be bypassed, in order to obtain sensitive information from local files. (CVE-2018-5118)
It was discovered that the reader view will load cross-origin content in violation of CORS headers. An attacker could exploit this to bypass CORS restrictions. (CVE-2018-5119)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 17.10: firefox 58.0+build6-0ubuntu0.17.10.1
Ubuntu 16.04 LTS: firefox 58.0+build6-0ubuntu0.16.04.1
Ubuntu 14.04 LTS: firefox 58.0+build6-0ubuntu0.14.04.1
After a standard system update you need to restart Firefox to make all the necessary changes.
References: https://www.ubuntu.com/usn/usn-3544-1 CVE-2018-5089, CVE-2018-5090, CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5105, CVE-2018-5106, CVE-2018-5107, CVE-2018-5108, CVE-2018-5109, CVE-2018-5111, CVE-2018-5112, CVE-2018-5113, CVE-2018-5114, CVE-2018-5115, CVE-2018-5116, CVE-2018-5117, CVE-2018-5118, CVE-2018-5119, CVE-2018-5122
Package Information: https://launchpad.net/ubuntu/+source/firefox/58.0+build6-0ubuntu0.17.10.1 https://launchpad.net/ubuntu/+source/firefox/58.0+build6-0ubuntu0.16.04.1 https://launchpad.net/ubuntu/+source/firefox/58.0+build6-0ubuntu0.14.04.1
--FubxZSknefpQse1Dq4fK3eVAFJhxSXF6s--
--pn7WMiqlwzzyWuw0zUbMZqsvd0OQHl6an Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQEcBAEBCAAGBQJaaO8fAAoJEGEfvezVlG4PSNAH/jrHWKlkbiLD1lrz/O0xx2Qe nXaB7+ydM1kHb05CXKmvdWZ0LOKf8Zcac55jue+1YIfi1a5H0G43/7LOEtpcQO7Q GVhwz8yFbTkLBy/T4oTZZ5kojks5eA1pAMhvDZGO5AzxpQhP0cGT+HhQNcLy3J5j DN/C1+kYlUl1qoihNpph2Njl9tZUEMFM5eVMfMKuIxwcxzxh2yddPzxvDHOBUOtG TwwHTWoTfH3UvwdUQJQwvIZWY4gIkjuoyvFjdIjV/BYj0aSBKrrvRniiCLKxnTEb TIXMiRMLEIuwnRk2IkoJUa6nialRoRMmBjhMb/HkNVfZVm39rMBcQT+a/mtiJj4= =lW2y -----END PGP SIGNATURE-----
--pn7WMiqlwzzyWuw0zUbMZqsvd0OQHl6an--
--===============2524718601751121538== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5 LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj dXJpdHktYW5ub3VuY2UK
--===============2524718601751121538==--
|