USN-3991-3

See a problem?
Source
https://ubuntu.com/security/notices/USN-3991-3
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-3991-3.json
JSON Data
https://api.osv.dev/v1/vulns/USN-3991-3
Published
2019-06-14T20:29:25.907660Z
Modified
2019-06-14T20:29:25.907660Z
Summary
firefox regression
Details

USN-3991-1 fixed vulnerabilities in Firefox, and USN-3991-2 fixed a subsequent regression. The update caused an additional regression that resulted in Firefox failing to load correctly after executing it in safe mode. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)

It was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

References

Affected packages

Ubuntu:18.04:LTS / firefox

Package

Name
firefox

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
67.0.2+build2-0ubuntu0.18.04.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "firefox-locale-sl": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-nl": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-kn": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-gl": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-fy": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-kk": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-km": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-or": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-az": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-lt": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-hy": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-eo": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-sv": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-testsuite": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-sr": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-is": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ca": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-uk": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ne": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ga": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-it": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ja": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-lg": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ms": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-zh-hans": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ia": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ko": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-hr": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-mai": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-nb": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-mozsymbols": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-vi": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-dev": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-he": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-sw": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-el": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-oc": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-xh": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-nn": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ar": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-csb": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-cs": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-gn": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-hsb": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-zu": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-my": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ro": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-globalmenu": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-nso": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-af": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-sk": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-si": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-cy": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-fa": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-cak": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-sq": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-en": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-tr": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-br": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-et": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ast": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-th": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-da": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-fi": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ku": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-mn": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ru": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-mk": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-bg": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-hu": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-gu": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-bn": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-kab": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ml": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-an": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-be": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-eu": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-fr": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-pa": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-as": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ta": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-pl": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-bs": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-te": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-id": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ka": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-lv": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-gd": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-uz": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-zh-hant": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-hi": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-es": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-de": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-mr": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-pt": "67.0.2+build2-0ubuntu0.18.04.1",
            "firefox-locale-ur": "67.0.2+build2-0ubuntu0.18.04.1"
        }
    ]
}

Ubuntu:16.04:LTS / firefox

Package

Name
firefox

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
67.0.2+build2-0ubuntu0.16.04.1

Ecosystem specific

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "firefox-locale-sl": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-nl": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-kn": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-gl": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-fy": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-kk": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-km": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-or": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-az": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-lt": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-hy": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-eo": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-sv": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-testsuite": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-sr": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-is": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ca": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-uk": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ne": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ga": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-it": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ja": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-lg": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ms": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-zh-hans": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ia": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ko": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-hr": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-mai": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-nb": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-mozsymbols": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-vi": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-dev": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-he": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-sw": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-el": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-oc": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-xh": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-nn": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ar": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-csb": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-cs": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-gn": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-hsb": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-zu": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-my": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ro": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-globalmenu": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-nso": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-af": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-sk": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-si": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-cy": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-fa": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-cak": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-sq": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-en": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-tr": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-br": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-et": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ast": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-th": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-da": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-fi": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ku": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-mn": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ru": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-mk": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-bg": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-hu": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-gu": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-bn": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-kab": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ml": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-an": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-be": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-eu": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-fr": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-pa": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-as": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ta": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-pl": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-bs": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-te": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-id": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ka": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-lv": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-gd": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-uz": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-zh-hant": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-hi": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-es": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-de": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-mr": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-pt": "67.0.2+build2-0ubuntu0.16.04.1",
            "firefox-locale-ur": "67.0.2+build2-0ubuntu0.16.04.1"
        }
    ]
}