Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Ubuntu 18.04 LTS: USN-3874-1 Moderate: Firefox Attack Risks

ubuntu
Calendar Grey January 30, 2019
Dist Ubuntu Esm H88
=========================================================================Ubuntu Security Notice USN-
Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Multiple security issues were discovered in Firefox. If a user were

tricked in to opening a specially crafted website, an attacker could

potentially exploit these to cause a denial of service, gain additional

privileges by escaping the sandbox, or execute arbitrary code.

(CVE-2018-18500, CVE-2018-18501, CVE-2018-18502, CVE-2018-18503,

CVE-2018-18504, CVE-2018-18505)

It was discovered that Firefox allowed PAC files to specify that requests

to localhost are sent through the proxy to another server. If proxy

auto-detection is enabled, an attacker could potentially exploit this to

conduct attacks on local services and tools. (CVE-2018-18506)

Topics%20covered

Topics Covered

security advisory firefox ubuntu application flaw malicious exploitation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.10:
  firefox                         65.0+build2-0ubuntu0.18.10.1

Ubuntu 18.04 LTS:
  firefox                         65.0+build2-0ubuntu0.18.04.1

Ubuntu 16.04 LTS:
  firefox                         65.0+build2-0ubuntu0.16.04.1

Ubuntu 14.04 LTS:
  firefox                         65.0+build2-0ubuntu0.14.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-3874-1

  CVE-2018-18500, CVE-2018-18501, CVE-2018-18502, CVE-2018-18503,

  CVE-2018-18504, CVE-2018-18505, CVE-2018-18506

January 30, 2019

Topics%20covered

Topics Covered

security advisory firefox ubuntu application flaw malicious exploitation

Package Information

  https://launchpad.net/ubuntu/+source/firefox/65.0+build2-0ubuntu0.18.10.1
  https://launchpad.net/ubuntu/+source/firefox/65.0+build2-0ubuntu0.18.04.1
  https://launchpad.net/ubuntu/+source/firefox/65.0+build2-0ubuntu0.16.04.1
  https://launchpad.net/ubuntu/+source/firefox/65.0+build2-0ubuntu0.14.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here