VulnerableCode Package Details - pkg:alpm/archlinux/firefox@71.0-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-6fvj-phnx-kfgs Aliases: CVE-2019-17023	After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-7hkk-2k6p-vyc7 Aliases: CVE-2019-17024	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-9v4g-hwwe-3ybg Aliases: CVE-2019-17025	Mozilla developers Karl Tomlinson, Jason Kratzer, Tyson Smith, Jon Coppeard, and Christian Holler reported memory safety bugs present in Firefox 71. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-ap8s-63rs-jyff Aliases: CVE-2019-17020	If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-c4qs-a9kw-p3hc Aliases: CVE-2019-17017	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-javq-3r82-73fq Aliases: CVE-2019-17022	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-x12h-hqf2-37cc Aliases: CVE-2019-17016	Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code.	72.0-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-6fvj-phnx-kfgs
Aliases:
CVE-2019-17023

After a HelloRetryRequest has been sent, the client may negotiate a lower protocol that TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data records will be ignored.