CVE-2019-17022

Priority
Description
When pasting a <style> tag from the clipboard into a rich text
editor, the CSS sanitizer does not escape < and > characters. Because
the resulting string is pasted directly into the text node of the element
this does not result in a direct injection into the webpage; however, if a
webpage subsequently copies the node's innerHTML, assigning it to another
innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors
were identified with this behavior, more may exist. This vulnerability
affects Firefox ESR < 68.4 and Firefox < 72.
Assigned-to
chrisccoulson
Notes
tyhicksmozjs contains a copy of the SpiderMonkey JavaScript engine
Package
Upstream:released (72.0)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (72.0.1+build1-0ubuntu0.16.04.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (72.0.1+build1-0ubuntu0.18.04.1)
Ubuntu 20.04 LTS (Focal Fossa):released (72.0.1+build1-0ubuntu1)
Ubuntu 20.10 (Groovy Gorilla):released (72.0.1+build1-0ubuntu1)
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):needs-triage
Ubuntu 20.04 LTS (Focal Fossa):DNE
Ubuntu 20.10 (Groovy Gorilla):DNE
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):needs-triage
Ubuntu 20.04 LTS (Focal Fossa):needs-triage
Ubuntu 20.10 (Groovy Gorilla):needs-triage
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 20.04 LTS (Focal Fossa):DNE
Ubuntu 20.10 (Groovy Gorilla):DNE
Package
Priority: Low
Upstream:released (68.4.1)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (1:68.7.0+build1-0ubuntu0.16.04.2)
Ubuntu 18.04 LTS (Bionic Beaver):released (1:68.4.1+build1-0ubuntu0.18.04.1)
Ubuntu 20.04 LTS (Focal Fossa):released (1:68.4.1+build1-0ubuntu1)
Ubuntu 20.10 (Groovy Gorilla):released (1:68.4.1+build1-0ubuntu1)
More Information

Updated: 2020-09-09 22:52:38 UTC (commit b67d7d8b03f173f825cd706df5bd078bca500b0e)