CVE-2019-17020
critical
CVSS v3
—
CVSS v2
—
VIR risk
9.5
Description
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2019-17020
Vendor advisory: arch — https://security.archlinux.org/ASA-202001-1
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | fixed | 72.0-1 | |
| debian | sid | fixed | 72.0-1 |
References
Verify integrity in audit chain (admin only). AS-IS.