USN-3516-1: Firefox vulnerabilities
It was discovered that speculative execution performed by modern CPUs could leak information through a timing side-channel attack, and that this could be exploited in web browser JavaScript engines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information from other domains, bypassing same-origin restrictions. (CVE-2017-5715, CVE-2017-5753, CVE-2017-5754).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 57.0.4+build1-0ubuntu0.17.10.1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 57.0.4+build1-0ubuntu0.17.04.1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 57.0.4+build1-0ubuntu0.16.04.1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 57.0.4+build1-0ubuntu0.14.04.1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Firefox vulnerability?
The vulnerability ID for this Firefox vulnerability is USN-3516-1.
What is the severity of USN-3516-1?
The severity of USN-3516-1 is not specified in the provided information.
How can this vulnerability be exploited?
This vulnerability can be exploited by tricking a user into opening a specially crafted website.
What software versions are affected by USN-3516-1?
Software versions 57.0.4+build1-0ubuntu0.17.10.1, 57.0.4+build1-0ubuntu0.17.04.1, 57.0.4+build1-0ubuntu0.16.04.1, and 57.0.4+build1-0ubuntu0.14.04.1 are affected by USN-3516-1.
How do I fix USN-3516-1?
To fix USN-3516-1, update Firefox to version 57.0.4+build1-0ubuntu0.17.10.1, 57.0.4+build1-0ubuntu0.17.04.1, 57.0.4+build1-0ubuntu0.16.04.1, or 57.0.4+build1-0ubuntu0.14.04.1.