CVE-2019-17020: canonical ubuntu_linux
Vulnerability summary
CVE-2019-17020 is a medium (CVSS 6.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 08-01-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.14%
Chance of exploitation in the next 30 days
Percentile
66%
Versus all other CVEs
30-day change
0.00 pp
From 1.15% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- firefox< 72.0.1+build1-0ubuntu0.16.04.1 | < 72.0.1+build1-0ubuntu0.18.04.1 | < 72.0.1+build1-0ubuntu1
- mozjs38All versions (No fix recorded)
- mozjs52All versions (No fix recorded)
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04 | 19.10
Mozilla1 product
- firefox< 72 | < 72.0
3 vendors · 5 products