CVE-2019-17022

Priority
Description
When pasting a <style> tag from the clipboard into a rich text
editor, the CSS sanitizer does not escape < and > characters. Because
the resulting string is pasted directly into the text node of the element
this does not result in a direct injection into the webpage; however, if a
webpage subsequently copies the node's innerHTML, assigning it to another
innerHTML, this would result in an XSS vulnerability. Two WYSIWYG editors
were identified with this behavior, more may exist. This vulnerability
affects Firefox ESR < 68.4 and Firefox < 72.
Assigned-to
chrisccoulson
Notes
tyhicksmozjs contains a copy of the SpiderMonkey JavaScript engine
Package
Upstream:released (72.0)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):released (72.0.1+build1-0ubuntu0.16.04.1)
Ubuntu 18.04 LTS (Bionic Beaver):released (72.0.1+build1-0ubuntu0.18.04.1)
Ubuntu 19.04 (Disco Dingo):released (72.0.1+build1-0ubuntu0.19.04.1)
Ubuntu 19.10 (Eoan Ermine):released (72.0.1+build1-0ubuntu0.19.10.1)
Ubuntu 20.04 (Focal Fossa):needed
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):needs-triage
Ubuntu 19.04 (Disco Dingo):DNE
Ubuntu 19.10 (Eoan Ermine):DNE
Ubuntu 20.04 (Focal Fossa):DNE
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):needs-triage
Ubuntu 19.04 (Disco Dingo):needs-triage
Ubuntu 19.10 (Eoan Ermine):needs-triage
Ubuntu 20.04 (Focal Fossa):needs-triage
Package
Upstream:needs-triage
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Ubuntu 18.04 LTS (Bionic Beaver):DNE
Ubuntu 19.04 (Disco Dingo):needs-triage
Ubuntu 19.10 (Eoan Ermine):needs-triage
Ubuntu 20.04 (Focal Fossa):needs-triage
Package
Priority: Low
Upstream:released (68.4.1)
Ubuntu 12.04 ESM (Precise Pangolin):DNE
Ubuntu 14.04 ESM (Trusty Tahr):DNE
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 18.04 LTS (Bionic Beaver):released (1:68.4.1+build1-0ubuntu0.18.04.1)
Ubuntu 19.04 (Disco Dingo):needed
Ubuntu 19.10 (Eoan Ermine):released (1:68.4.1+build1-0ubuntu0.19.10.1)
Ubuntu 20.04 (Focal Fossa):released (1:68.4.1+build1-0ubuntu1)
More Information

Updated: 2020-01-16 18:14:31 UTC (commit b056c3ae13f0ed3c50fbb69ff075b92ec002bb63)