CVE-2019-17020: XEE
First published: Tue Jan 07 2020(Updated: )
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <72 | 72 |
| Mozilla Firefox | <72.0 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =19.04 | |
| Canonical Ubuntu Linux | =19.10 | |
| debian/firefox | 132.0.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.mozilla.org/security/advisories/mfsa2020-01/
- https://bugzilla.mozilla.org/show_bug.cgi?id=1597645
- https://usn.ubuntu.com/4234-1/
- https://launchpad.net/bugs/cve/CVE-2019-17020
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17016
- https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17020
- https://security-tracker.debian.org/tracker/CVE-2019-17020
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17020
- https://nvd.nist.gov/vuln/detail/CVE-2019-17020
- https://ubuntu.com/security/CVE-2019-17020
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2019-17020?
CVE-2019-17020 is a vulnerability that allows an XML file with an XSL stylesheet to bypass the Content Security Policy.
What is the severity of CVE-2019-17020?
CVE-2019-17020 has a severity of 6.5, which is considered medium.
Which software products are affected by CVE-2019-17020?
Mozilla Firefox versions up to 72.0.1 and Ubuntu Linux with Firefox up to version 72.0.1 are affected by CVE-2019-17020.
How can I fix CVE-2019-17020?
To fix CVE-2019-17020, update Mozilla Firefox to version 72.0.1 or later, or update Ubuntu Linux with Firefox to version 72.0.1 or later.
Where can I find more information about CVE-2019-17020?
For more information about CVE-2019-17020, you can visit the following references: [Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1597645), [Mozilla Security Advisories](https://www.mozilla.org/en-US/security/advisories/mfsa2020-01/)
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/description
- agent/severity
- agent/weakness
- collector/mozilla-advisory
- agent/software-canonical-lookup-request
- source/Mozilla
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/usn-cve
- source/Ubuntu
- vendor/mozilla
- canonical/mozilla firefox
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/19.04
- version/canonical ubuntu linux/19.10
- package-manager/debian