Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2019-17016

MEDIUM6.1

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites res

Published Jan 8, 2020

Modified 7 months ago

Fix available

Details

When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for injection into certain types of websites resulting in data exfiltration. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.

Affected Packages

Ubuntu:16.04:LTSfirefox

Affected versions:

41.0.2+build2-0ubuntu142.0+build2-0ubuntu144.0+build3-0ubuntu244.0.1+build1-0ubuntu144.0.2+build1-0ubuntu145.0+build2-0ubuntu145.0.1+build1-0ubuntu145.0.2+build1-0ubuntu146.0+build5-0ubuntu0.16.04.246.0.1+build1-0ubuntu0.16.04.2+66 more

Fixed in:

72.0.1+build1-0ubuntu0.16.04.1

Ubuntu:18.04:LTSfirefox

Affected versions:

56.0+build6-0ubuntu157.0.1+build2-0ubuntu159.0.1+build1-0ubuntu159.0.2+build1-0ubuntu160.0+build2-0ubuntu160.0.1+build2-0ubuntu0.18.04.160.0.2+build1-0ubuntu0.18.04.161.0+build3-0ubuntu0.18.04.161.0.1+build1-0ubuntu0.18.04.162.0+build2-0ubuntu0.18.04.3+28 more

Fixed in:

72.0.1+build1-0ubuntu0.18.04.1

Ubuntu:20.04:LTSfirefox

Affected versions:

69.0.3+build1-0ubuntu170.0+build2-0ubuntu170.0+build2-0ubuntu270.0.1+build1-0ubuntu271.0+build2-0ubuntu271.0+build5-0ubuntu1

Fixed in:

72.0.1+build1-0ubuntu1

Ubuntu:Pro:18.04:LTSmozjs38

Affected versions:

38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4

Ubuntu:Pro:18.04:LTSmozjs52

Affected versions:

52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1

Ubuntu:Pro:20.04:LTSmozjs52

Affected versions:

52.9.1-1build152.9.1-1ubuntu3

Ubuntu:16.04:LTSthunderbird

Affected versions:

1:38.3.0+build1-0ubuntu21:38.5.1+build2-0ubuntu11:38.6.0+build1-0ubuntu11:38.7.2+build1-0ubuntu0.16.04.11:38.8.0+build1-0ubuntu0.16.04.11:45.2.0+build1-0ubuntu0.16.04.11:45.3.0+build1-0ubuntu0.16.04.21:45.4.0+build1-0ubuntu0.16.04.11:45.5.1+build1-0ubuntu0.16.04.11:45.7.0+build1-0ubuntu0.16.04.1+20 more

Fixed in:

1:68.7.0+build1-0ubuntu0.16.04.2

Ubuntu:18.04:LTSthunderbird

Affected versions:

1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.11:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.1+6 more

Fixed in:

1:68.4.1+build1-0ubuntu0.18.04.1

Ubuntu:20.04:LTSthunderbird

Affected versions:

1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu11:68.3.1+build1-0ubuntu2

Fixed in:

1:68.4.1+build1-0ubuntu1

References

REPORThttps://bugzilla.mozilla.org/show_bug.cgi?id=1599181 REPORThttps://ubuntu.com/security/CVE-2019-17016 REPORThttps://ubuntu.com/security/notices/USN-4234-1 REPORThttps://ubuntu.com/security/notices/USN-4241-1 REPORThttps://ubuntu.com/security/notices/USN-4335-1 REPORThttps://www.cve.org/CVERecord?id=CVE-2019-17016 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17016 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2020-02/#CVE-2019-17016 REPORThttps://www.mozilla.org/en-US/security/advisories/mfsa2020-04/#CVE-2019-17016 REPORThttps://www.mozilla.org/security/advisories/mfsa2020-01/REPORThttps://www.mozilla.org/security/advisories/mfsa2020-02/

CVSS Analysis

CVSS v3.1

6.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE-2019-17016 USN-4234-1 USN-4241-1 USN-4335-1

Ecosystems

Ubuntu 16.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS

Timeline

PublishedJan 8, 2020

ModifiedJun 3, 2025

UBUNTU-CVE-2019-17016 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2019-17016

Details

Affected Packages

References

CVSS Analysis

Related

Ecosystems

Timeline