PT-2019-4867 · Mozilla+2 · Firefox+2

Matthew Somerville · Published 2019-12-03 · Updated 2024-12-12 · CVE-2019-17020

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 72

Description The issue is related to a security policy error that does not apply to the contents of an XSL stylesheet when an XML file is served with a Content Security Policy and includes an XSL stylesheet. This could allow a remote attacker to compromise data integrity, particularly if the XSL sheet includes JavaScript, thereby bypassing the restrictions of the Content Security Policy applied to the XML document.

Recommendations For Firefox versions prior to 72, update to version 72 or later to resolve the issue. As a temporary workaround, consider restricting the use of XSL stylesheets in XML files served with a Content Security Policy until a patch is applied.

Fix

XXE

RCE

Weakness Enumeration

CWE-611

CWE-20

Related Identifiers

ALT-PU-2020-1110

ALT-PU-2020-1617

ALT-PU-2020-2408

ALT-PU-2020-2933

ALT-PU-2021-1368

BDU:2020-01454

CVE-2019-17020

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-4234-1

USN-4234-2

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1889

• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01454 · Security Note
• https://ubuntu.com/security/CVE-2019-17025 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2020-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17024 · Vendor Advisory
• https://usn.ubuntu.com/4234-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-17020 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17026 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17017 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-17022 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-17020 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2020-01/#CVE-2019-17020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17020 · Security Note
• https://ubuntu.com/security/CVE-2019-17020 · Vendor Advisory