WebExtensions can use request redirection and a "filterReponseData" filter to bypass host permission settings to redirect network traffic and access content from a host for which they do not have explicit user permission. This vulnerability affects Firefox < 60.

This update for MozillaFirefox to 68.2.0 ESR fixes the following issues :

Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).

Security issues fixed :

CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).

CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).

CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).

CVE-2019-11759: Fixed a stack-based buffer overflow in HKDF output (bsc#1154738).

CVE-2019-11760: Fixed a stack-based buffer overflow in WebRTC networking (bsc#1154738).

CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).

CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).

CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).

CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed: Firefox 60.7 ESR changed the user interface language (bsc#1137990).

Wrong Firefox GUI Language (bsc#1120374).

Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).

Firefox hangs randomly when browsing and scrolling (bsc#1043008).

Firefox stops loading page until mouse is moved (bsc#1025108).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Mozilla Firefox installed on the remote Windows     host is prior to 60. It is, therefore, affected by multiple critical     and high severity vulnerabilities.

The version of Mozilla Firefox installed on the remote macOS or     Mac OS X host is prior to 60. It is, therefore, affected by multiple     critical and high severity vulnerabilities.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3645-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service via application     crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight     themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code.
    (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158,     CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175,     CVE-2018-5177, CVE-2018-5180)

    Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a     specially crafted extension, an attacker could potentially exploit these to obtain sensitive information,     or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166)

    It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and     javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could     potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167)

    It was discovered that dragging and dropping link text on to the home button could set the home page to     include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to     the home button, an attacker could potentially exploit this bypass security restrictions. (CVE-2018-5169)

    It was discovered that the Live Bookmarks page and PDF viewer would run script pasted from the clipboard.
    If a user were tricked in to copying and pasting specially crafted text, an attacker could potentially     exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5172)

    It was discovered that the JSON viewer incorrectly linkified javascript: URLs. If a user were tricked in     to clicking on a specially crafted link, an attacker could potentially exploit this to obtain sensitive     information. (CVE-2018-5176)

    It was discovered that dragging a file: URL on to a tab that is running in a different process would cause     the file to open in that process. If a user were tricked in to dragging a file: URL, an attacker could     potentially exploit this to bypass intended security policies. (CVE-2018-5181)

    It was discovered that dragging text that is a file: URL on to the addressbar would open the specified     file. If a user were tricked in to dragging specially crafted text on to the addressbar, an attacker could     potentially exploit this to bypass intended security policies. (CVE-2018-5182)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mozilla Foundation reports :

CVE-2018-5183: Backport critical security fixes in Skia

CVE-2018-5154: Use-after-free with SVG animations and clip paths

CVE-2018-5155: Use-after-free with SVG animations and text paths

CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files

CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer

CVE-2018-5159: Integer overflow and out-of-bounds write in Skia

CVE-2018-5160: Uninitialized memory use by WebRTC encoder

CVE-2018-5152: WebExtensions information leak through webRequest API

CVE-2018-5153: Out-of-bounds read in mixed content websocket messages

CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache

CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace

CVE-2018-5166: WebExtension host permission bypass through filterReponseData

CVE-2018-5167: Improper linkification of chrome: and javascript:
content in web console and JavaScript debugger

CVE-2018-5168: Lightweight themes can be installed without user interaction

CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages

CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer

CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters

CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update

CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies

CVE-2018-5176: JSON Viewer script injection

CVE-2018-5177: Buffer overflow in XSLT during number formatting

CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox

CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced

CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink

CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar

CVE-2018-5151: Memory safety bugs fixed in Firefox 60

CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8

ID	Name	Product	Family	Severity
130450	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2872-1)	Nessus	SuSE Local Security Checks	critical
109869	Mozilla Firefox < 60 Multiple Critical Vulnerabilities	Nessus	Windows	critical
109867	Mozilla Firefox < 60 Multiple Critical Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	critical
109798	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Firefox vulnerabilities (USN-3645-1)	Nessus	Ubuntu Local Security Checks	critical
109661	FreeBSD : mozilla -- multiple vulnerabilities (5aefc41e-d304-4ec8-8c82-824f84f08244)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-5166

high

Tenable Plugins

critical

critical

critical

critical

critical