MGASA-2019-0267

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2019-0267.html
Import Source
https://advisories.mageia.org/MGASA-2019-0267.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2019-0267
Related
Published
2019-09-12T19:09:52Z
Modified
2019-09-12T18:17:59Z
Summary
Updated firefox packages fix security vulnerabilities
Details

The updated packages fix several bugs and some security issues:

Sandbox escape through Firefox Sync. (CVE-2019-9812)

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)

Cross-origin access to unload event attributes. (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)

Use-after-free while manipulating video. (CVE-2019-11746)

Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)

Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)

References
Credits

Affected packages

Mageia:6 / firefox

Package

Name
firefox
Purl
pkg:rpm/mageia/firefox?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
60.9.0-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / firefox-l10n

Package

Name
firefox-l10n
Purl
pkg:rpm/mageia/firefox-l10n?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
60.9.0-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / rootcerts

Package

Name
rootcerts
Purl
pkg:rpm/mageia/rootcerts?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20190820.00-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / nspr

Package

Name
nspr
Purl
pkg:rpm/mageia/nspr?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.22-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:6 / nss

Package

Name
nss
Purl
pkg:rpm/mageia/nss?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.36.8-1.2.mga6

Ecosystem specific 

{
    "section": "core"
}