Linux · 
Ubuntu · Package update · July 9, 2020
Ubuntu · Package update · July 9, 2020firefox 70.0+build2-0ubuntu0.18.04.1: firefox 70.0+build2-0ubuntu0.18.04.1 for Ubuntu 18.04.6 LTS (bionic)
firefox 70.0+build2-0ubuntu0.18.04.1, released July 9, 2020, fixes 14 CVEs in firefox. None of them is reported as exploited. Patch Radar priority: Urgent. The product is no longer supported.
UrgentUnsupported product
CVEs closed
14
7 rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0664
93rd percentile
Priority of the 14 CVEs
Patch now 0
Urgent 7
High 2
Routine 5
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | Ubuntu 18.04.6 LTS (bionic) | 70.0+build2-0ubuntu0.18.04.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| Urgent | CVE-2019-11759 | Firefox ESR: An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on… | 8.8 | 0.0165 | None reported |
| Urgent | CVE-2019-11764 | Firefox ESR: Mozilla developers and community members reported memory safety bugs present in Firefox 69 and Firefox… | 8.8 | 0.0147 | None reported |
| Urgent | CVE-2019-11760 | Firefox ESR: A fixed-size stack buffer could overflow in nrappkit when doing WebRTC signaling. | 8.8 | 0.0137 | None reported |
| Urgent | CVE-2019-11757 | Firefox ESR: When following the value's prototype chain, it was possible to retain a reference to a locale, delete… | 8.8 | 0.0133 | None reported |
| Urgent | CVE-2019-11763 | Firefox ESR: Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly… | 6.1 | 0.0115 | None reported |
| Urgent | CVE-2019-11761 | Firefox ESR: By using a form with a data URI it was possible to gain access to the privileged JSONView object that… | 5.4 | 0.0079 | None reported |
| Urgent | CVE-2019-11762 | Firefox ESR: If two same-origin documents set document.domain differently to become cross-origin, it was possible… | 6.1 | 0.0061 | None reported |
| High | CVE-2019-15903 | Python 3.6 and 2 others: Out-of-bounds Read | 7.5 | 0.0664 | None reported |
| High | CVE-2018-6156 | chromium-browser: Incorect derivation of a packet length in WebRTC in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to... | n/a | 0.0086 | None reported |
| Routine | CVE-2019-11765 | Firefox ESR: A compromised content process could send a message to the parent process that would cause the 'Click… | 6.5 | 0.0084 | None reported |
| Routine | CVE-2019-17000 | Firefox ESR: An object tag with a data URI did not correctly inherit the document's Content Security Policy. | 6.1 | 0.0081 | None reported |
| Routine | CVE-2019-17001 | firefox: A Content-Security-Policy that blocks in-line scripts could be bypassed using an object tag to execute JavaScript in... | n/a | 0.0080 | None reported |
| Routine | CVE-2020-12412 | Firefox ESR: By navigating a tab using the history API, an attacker could cause the address bar to display the incorrect… | 4.3 | 0.0078 | None reported |
| Routine | CVE-2019-17002 | Firefox ESR: If upgrade-insecure-requests was specified in the Content Security Policy, and a link was dragged and… | 4.3 | 0.0073 | None reported |
Showing 1 to 14 of 14
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.