ASA-201903-14 log original external raw

Arch Linux Security Advisory ASA-201903-14 ========================================== Severity: Critical Date : 2019-03-23 CVE-ID : CVE-2019-9810 CVE-2019-9813 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-930 Summary ======= The package firefox before version 66.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 66.0.1-1. # pacman -Syu "firefox>=66.0.1-1" The problems have been fixed upstream in version 66.0.1. Workaround ========== None. Description =========== - CVE-2019-9810 (arbitrary code execution) An incorrect alias information in the IonMonkey JIT compiler of Firefox before 66.0.1 and Thunderbird before 60.6.1 for the Array.prototype.slice method may lead to missing bounds check and a buffer overflow. - CVE-2019-9813 (arbitrary code execution) An incorrect handling of __proto__ mutations may lead to type confusion in the IonMonkey JIT code of Firefox before 66.0.1 and Thunderbird before 60.6.1, and can be leveraged for arbitrary memory read and write. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9810 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9810 https://bugzilla.mozilla.org/show_bug.cgi?id=1537924 https://www.mozilla.org/en-US/security/advisories/mfsa2019-09/#CVE-2019-9813 https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/#CVE-2019-9813 https://bugzilla.mozilla.org/show_bug.cgi?id=1538006 https://security.archlinux.org/CVE-2019-9810 https://security.archlinux.org/CVE-2019-9813