SB2018012409 - Ubuntu update for Firefox

Description

This security bulletin contains information about 30 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2018-5089)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious input. A remote attacker can trick the victim into visiting a specially crafted website, trigger mmeory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

2) Memory corruption (CVE-ID: CVE-2018-5090)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious input. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

3) Use-after-free error (CVE-ID: CVE-2018-5091)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error during WebRTC connections when interacting with the DTMF timers. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

4) Use-after-free error (CVE-ID: CVE-2018-5092)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in a Web Worker. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

5) Buffer overflow (CVE-ID: CVE-2018-5093)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in WebAssembly during Memory/Table resizing. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

6) Buffer overflow (CVE-ID: CVE-2018-5094)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in WebAssembly when shrinkElements is called followed by garbage collection on memory. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

7) Integer overflow (CVE-ID: CVE-2018-5095)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in the Skia library when allocating memory for edge builders. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

8) Use-after-free error (CVE-ID: CVE-2018-5097)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error during XSL transformations. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

9) Use-after-free error (CVE-ID: CVE-2018-5098)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when manipulating form input elements. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

10) Use-after-free error (CVE-ID: CVE-2018-5099)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error in the widget listener. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

11) Use-after-free error (CVE-ID: CVE-2018-5100)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when IsPotentiallyScrollable arguments are freed from memory. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

12) Use-after-free error (CVE-ID: CVE-2018-5101)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when manipulating floating first-letter style elements. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

13) Use-after-free error (CVE-ID: CVE-2018-5102)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when manipulating HTML media elements with media streams. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

14) Use-after-free error (CVE-ID: CVE-2018-5103)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error during mouse event handling. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

15) Use-after-free error (CVE-ID: CVE-2018-5104)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error during font face manipulation. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

16) Security restrictions bypass (CVE-ID: CVE-2018-5109)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the prompting and starting an audio capture session with an incorrect origin from the site making the capture request. A remote attacker can bypass security restrictions and cause user confusion about which site is making the request to capture an audio stream.

17) Security restrictions bypass (CVE-ID: CVE-2018-5114)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to an error when the old value of an existing cookie changed to be HttpOnly remains accessible to scripts. A remote attacker can bypass security restrictions and gain access to the application.

18) Information disclosure (CVE-ID: CVE-2018-5115)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error when an HTTP authentication prompt is triggered by a background network request. A remote attacker can open an HTTP authentication over the foreground page and send private credential information to a third party site.

19) Spoofing attack (CVE-ID: CVE-2018-5117)

The vulnerability allows a remote attacker to spoof browser address bar.

The vulnerability exists due to an error when right-to-left text is used in the addressbar with left-to-right alignment. A remote attacker can trick the victim into visiting a specially crafted website, and spoof the URL.

20) Integer overflow (CVE-ID: CVE-2018-5122)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to integer overflow in the DoCrypt function of WebCrypto. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

21) Privilege escalation (CVE-ID: CVE-2018-5105)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to an error in WebExtensions. A local attacker can bypass prompts to save and open an arbitrarily downloaded file and execute arbitrary code with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

22) Security restrictions bypass (CVE-ID: CVE-2018-5113)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the failure to enforce the requirement of the browser.identity.launchWebAuthFlow function of WebExtensions is only allowed to load content over https:.. A remote attacker can bypass security restrictions and load privileges pages.

23) Information disclosure (CVE-ID: CVE-2018-5116)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to an error in WebExtensions with the ActiveTab permission. A remote attacker can bypass security restrictions and access cross-origin frame content.

24) Information disclosure (CVE-ID: CVE-2018-5106)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in the Developer Tools. A remote attacker can route style editor traffic through a service worker hosted on a third party website, bypass cross-origin restrictions via Developer Tools and obtain arbitrary files.

25) Information disclosure (CVE-ID: CVE-2018-5107)

The vulnerability allows a local attacker to launch a symlink attack on the target system.

The weakness exists due to an error in the printing process. A local attacker can create a symbolic link from a temporary file to various files on the system, bypass local access protections to read files available.

26) Information disclosure (CVE-ID: CVE-2018-5108)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to an error in a manually entered Blob URL. A remote attacker can access the Blob URL from a private browsing tab and obtain private information specific to the private browsing context.

27) Spoofing attack (CVE-ID: CVE-2018-5111)

The vulnerability allows a remote attacker to spoof browser address bar.

The vulnerability exists due to unspecified error. A remote attacker can trick the victim into visiting a specially crafted website, use drag and drop operation and spoof the displayed URL in addressbar.

28) Security restrictions bypass (CVE-ID: CVE-2018-5112)

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to the failure to enforce the requirement of the Development Tools panels of an extension to load URLs for the panels as relative URLs from the extension manifest file. A remote attacker can bypass security restrictions and load a URL that it should not be able to access.

29) Information disclosure (CVE-ID: CVE-2018-5118)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to an error in the Activity Stream page when attempting to create screenshot images through file: URLs from the local file system. A remote attacker can bypass security restrictions and expose local data if combined with another attack that escapes sandbox protections.

30) Information disclosure (CVE-ID: CVE-2018-5119)

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to the displaying of cross-origin content when CORS headers are set to prohibit the loading of cross-origin content by a site. A remote attacker can bypass cross-origin content restrictions in Reader view and gain access to content that should be restricted in reader view.

Remediation

Install update from vendor's website.

References

• http://www.ubuntu.com/usn/usn-3544-1/