{"id":"USN-3544-2","summary":"firefox regressions","details":"USN-3544-1 fixed vulnerabilities in Firefox. The update caused a web\ncompatibility regression and a tab crash during printing in some\ncircumstances. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Multiple security issues were discovered in Firefox. If a user were\n tricked in to opening a specially crafted website, an attacker could\n potentially exploit these to cause a denial of service via application\n crash, spoof the origin in audio capture prompts, trick the user in to\n providing HTTP credentials for another origin, spoof the addressbar\n contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090,\n CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095,\n CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101,\n CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109, CVE-2018-5114,\n CVE-2018-5115, CVE-2018-5117, CVE-2018-5122)\n \n Multiple security issues were discovered in WebExtensions. If a user were\n tricked in to installing a specially crafted extension, an attacker could\n potentially exploit these to gain additional privileges, bypass\n same-origin restrictions, or execute arbitrary code. (CVE-2018-5105,\n CVE-2018-5113, CVE-2018-5116)\n \n A security issue was discovered with the developer tools. If a user were\n tricked in to opening a specially crafted website with the developer tools\n open, an attacker could potentially exploit this to obtain sensitive\n information from other origins. (CVE-2018-5106)\n \n A security issue was discovered with printing. An attacker could\n potentially exploit this to obtain sensitive information from local files.\n (CVE-2018-5107)\n \n It was discovered that manually entered blob URLs could be accessed by\n subsequent private browsing tabs. If a user were tricked in to entering\n a blob URL, an attacker could potentially exploit this to obtain sensitive\n information from a private browsing context. (CVE-2018-5108)\n \n It was discovered that dragging certain specially formatted URLs to the\n addressbar could cause the wrong URL to be displayed. If a user were\n tricked in to opening a specially crafted website and dragging a URL to\n the addressbar, an attacker could potentially exploit this to spoof the\n addressbar contents. (CVE-2018-5111)\n \n It was discovered that WebExtension developer tools panels could open\n non-relative URLs. If a user were tricked in to installing a specially\n crafted extension and running the developer tools, an attacker could\n potentially exploit this to gain additional privileges. (CVE-2018-5112)\n \n It was discovered that ActivityStream images can attempt to load local\n content through file: URLs. If a user were tricked in to opening a\n specially crafted website, an attacker could potentially exploit this in\n combination with another vulnerability that allowed sandbox protections to\n be bypassed, in order to obtain sensitive information from local files.\n (CVE-2018-5118)\n \n It was discovered that the reader view will load cross-origin content in\n violation of CORS headers. An attacker could exploit this to bypass CORS\n restrictions. (CVE-2018-5119)\n","modified":"2026-04-22T09:43:03.509631Z","published":"2018-02-12T22:54:32Z","references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-3544-2"},{"type":"REPORT","url":"https://launchpad.net/bugs/1749025"}],"affected":[{"package":{"name":"firefox","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/firefox@58.0.2+build1-0ubuntu0.14.04.1?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.0.2+build1-0ubuntu0.14.04.1"}]}],"versions":["24.0+build1-0ubuntu1","25.0+build3-0ubuntu0.13.10.1","28.0~b2+build1-0ubuntu2","28.0+build1-0ubuntu1","28.0+build2-0ubuntu1","28.0+build2-0ubuntu2","29.0+build1-0ubuntu0.14.04.2","30.0+build1-0ubuntu0.14.04.3","31.0+build1-0ubuntu0.14.04.1","32.0+build1-0ubuntu0.14.04.1","32.0.3+build1-0ubuntu0.14.04.1","33.0+build2-0ubuntu0.14.04.1","34.0+build2-0ubuntu0.14.04.1","35.0+build3-0ubuntu0.14.04.2","35.0.1+build1-0ubuntu0.14.04.1","36.0+build2-0ubuntu0.14.04.4","36.0.1+build2-0ubuntu0.14.04.1","36.0.4+build1-0ubuntu0.14.04.1","37.0+build2-0ubuntu0.14.04.1","37.0.1+build1-0ubuntu0.14.04.1","37.0.2+build1-0ubuntu0.14.04.1","38.0+build3-0ubuntu0.14.04.1","39.0+build5-0ubuntu0.14.04.1","39.0.3+build2-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.1","40.0+build4-0ubuntu0.14.04.4","40.0.3+build1-0ubuntu0.14.04.1","41.0+build3-0ubuntu0.14.04.1","41.0.1+build2-0ubuntu0.14.04.1","41.0.2+build2-0ubuntu0.14.04.1","42.0+build2-0ubuntu0.14.04.1","43.0+build1-0ubuntu0.14.04.1","43.0.4+build3-0ubuntu0.14.04.1","44.0+build3-0ubuntu0.14.04.1","44.0.1+build2-0ubuntu0.14.04.1","44.0.2+build1-0ubuntu0.14.04.1","45.0+build2-0ubuntu0.14.04.1","45.0.1+build1-0ubuntu0.14.04.2","45.0.2+build1-0ubuntu0.14.04.1","46.0+build5-0ubuntu0.14.04.2","46.0.1+build1-0ubuntu0.14.04.3","47.0+build3-0ubuntu0.14.04.1","48.0+build2-0ubuntu0.14.04.1","49.0+build4-0ubuntu0.14.04.1","49.0.2+build2-0ubuntu0.14.04.1","50.0+build2-0ubuntu0.14.04.2","50.0.2+build1-0ubuntu0.14.04.1","50.1.0+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.1","51.0.1+build2-0ubuntu0.14.04.2","52.0+build2-0ubuntu0.14.04.1","52.0.1+build2-0ubuntu0.14.04.1","52.0.2+build1-0ubuntu0.14.04.1","53.0+build6-0ubuntu0.14.04.1","53.0.2+build1-0ubuntu0.14.04.2","53.0.3+build1-0ubuntu0.14.04.2","54.0+build3-0ubuntu0.14.04.1","55.0.1+build2-0ubuntu0.14.04.2","55.0.2+build1-0ubuntu0.14.04.1","56.0+build6-0ubuntu0.14.04.1","56.0+build6-0ubuntu0.14.04.2","57.0+build4-0ubuntu0.14.04.4","57.0+build4-0ubuntu0.14.04.5","57.0.1+build2-0ubuntu0.14.04.1","57.0.3+build1-0ubuntu0.14.04.1","57.0.4+build1-0ubuntu0.14.04.1","58.0+build6-0ubuntu0.14.04.1","58.0.1+build1-0ubuntu0.14.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"58.0.2+build1-0ubuntu0.14.04.1","binary_name":"firefox"},{"binary_version":"58.0.2+build1-0ubuntu0.14.04.1","binary_name":"firefox-globalmenu"},{"binary_version":"58.0.2+build1-0ubuntu0.14.04.1","binary_name":"firefox-mozsymbols"},{"binary_version":"58.0.2+build1-0ubuntu0.14.04.1","binary_name":"firefox-testsuite"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3544-2.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:14.04:LTS"}}},{"package":{"name":"firefox","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/firefox@58.0.2+build1-0ubuntu0.16.04.1?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"58.0.2+build1-0ubuntu0.16.04.1"}]}],"versions":["41.0.2+build2-0ubuntu1","42.0+build2-0ubuntu1","44.0+build3-0ubuntu2","44.0.1+build1-0ubuntu1","44.0.2+build1-0ubuntu1","45.0+build2-0ubuntu1","45.0.1+build1-0ubuntu1","45.0.2+build1-0ubuntu1","46.0+build5-0ubuntu0.16.04.2","46.0.1+build1-0ubuntu0.16.04.2","47.0+build3-0ubuntu0.16.04.1","48.0+build2-0ubuntu0.16.04.1","49.0+build4-0ubuntu0.16.04.1","49.0.2+build2-0ubuntu0.16.04.2","50.0+build2-0ubuntu0.16.04.2","50.0.2+build1-0ubuntu0.16.04.1","50.1.0+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.1","51.0.1+build2-0ubuntu0.16.04.2","52.0+build2-0ubuntu0.16.04.1","52.0.1+build2-0ubuntu0.16.04.1","52.0.2+build1-0ubuntu0.16.04.1","53.0+build6-0ubuntu0.16.04.1","53.0.2+build1-0ubuntu0.16.04.2","53.0.3+build1-0ubuntu0.16.04.2","54.0+build3-0ubuntu0.16.04.1","55.0.1+build2-0ubuntu0.16.04.2","55.0.2+build1-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.1","56.0+build6-0ubuntu0.16.04.2","57.0+build4-0ubuntu0.16.04.5","57.0+build4-0ubuntu0.16.04.6","57.0.1+build2-0ubuntu0.16.04.1","57.0.3+build1-0ubuntu0.16.04.1","57.0.4+build1-0ubuntu0.16.04.1","58.0+build6-0ubuntu0.16.04.1","58.0.1+build1-0ubuntu0.16.04.1"],"ecosystem_specific":{"binaries":[{"binary_version":"58.0.2+build1-0ubuntu0.16.04.1","binary_name":"firefox"},{"binary_version":"58.0.2+build1-0ubuntu0.16.04.1","binary_name":"firefox-globalmenu"},{"binary_version":"58.0.2+build1-0ubuntu0.16.04.1","binary_name":"firefox-mozsymbols"},{"binary_version":"58.0.2+build1-0ubuntu0.16.04.1","binary_name":"firefox-testsuite"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3544-2.json","cves_map":{"cves":[],"ecosystem":"Ubuntu:16.04:LTS"}}}],"schema_version":"1.7.5"}