USN-3874-1: Firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18500, CVE-2018-18501, CVE-2018-18502, CVE-2018-18503, CVE-2018-18504, CVE-2018-18505) It was discovered that Firefox allowed PAC files to specify that requests to localhost are sent through the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit this to conduct attacks on local services and tools. (CVE-2018-18506)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 65.0+build2-0ubuntu0.18.10.1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 65.0+build2-0ubuntu0.18.04.1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 65.0+build2-0ubuntu0.16.04.1 - Upgrade
Upgrade
ubuntu/firefoxto a version that resolves this vulnerability.Fixed in 65.0+build2-0ubuntu0.14.04.1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-3874-1?
The severity of USN-3874-1 is high.
What is the impact of the Firefox vulnerabilities in USN-3874-1?
If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these vulnerabilities to cause a denial of service, gain additional privileges by escaping the sandbox, or execute arbitrary code.
Which versions of Ubuntu are affected by USN-3874-1?
Ubuntu 18.10, 18.04, 16.04, and 14.04 are affected by USN-3874-1.
How can I fix the Firefox vulnerabilities in USN-3874-1?
Update to Firefox version 65.0+build2-0ubuntu0.18.10.1 for Ubuntu 18.10, version 65.0+build2-0ubuntu0.18.04.1 for Ubuntu 18.04, version 65.0+build2-0ubuntu0.16.04.1 for Ubuntu 16.04, or version 65.0+build2-0ubuntu0.14.04.1 for Ubuntu 14.04.
Where can I find more information about the Firefox vulnerabilities in USN-3874-1?
You can find more information about the Firefox vulnerabilities in USN-3874-1 on the Ubuntu Security Notices website at [CVE-2018-18500](https://ubuntu.com/security/CVE-2018-18500), [CVE-2018-18501](https://ubuntu.com/security/CVE-2018-18501), and [CVE-2018-18502](https://ubuntu.com/security/CVE-2018-18502).