CVE catalog

CVE-2019-17020

UBUNTU-CVE-2019-17020

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Published: Jan 8, 2020, 10:15:00 PM UTC
Updated: Apr 22, 2026, 12:12:46 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.14% · Oct 25, 2026

If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security Policy applied to the XML document. This vulnerability affects Firefox < 72.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Ubuntu	firefox	16.04	`41.0.2+build2-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`42.0+build2-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`44.0+build3-0ubuntu2`	vulnerable
Ubuntu	firefox	16.04	`44.0.1+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`44.0.2+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`45.0+build2-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`45.0.1+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`45.0.2+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	16.04	`46.0+build5-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`46.0.1+build1-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`47.0+build3-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`48.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`49.0+build4-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`49.0.2+build2-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`50.0+build2-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`50.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`50.1.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`51.0.1+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`51.0.1+build2-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`52.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`52.0.1+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`52.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`53.0+build6-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`53.0.2+build1-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`53.0.3+build1-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`54.0+build3-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`55.0.1+build2-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`55.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`56.0+build6-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`56.0+build6-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`57.0+build4-0ubuntu0.16.04.5`	vulnerable
Ubuntu	firefox	16.04	`57.0+build4-0ubuntu0.16.04.6`	vulnerable
Ubuntu	firefox	16.04	`57.0.1+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`57.0.3+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`57.0.4+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`58.0+build6-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`58.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`58.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`59.0+build5-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`59.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`59.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`59.0.2+build1-0ubuntu0.16.04.3`	vulnerable
Ubuntu	firefox	16.04	`60.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`60.0.1+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`60.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`61.0+build3-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`61.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`62.0+build2-0ubuntu0.16.04.3`	vulnerable
Ubuntu	firefox	16.04	`62.0+build2-0ubuntu0.16.04.4`	vulnerable
Ubuntu	firefox	16.04	`62.0+build2-0ubuntu0.16.04.5`	vulnerable
Ubuntu	firefox	16.04	`62.0.3+build1-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`63.0+build2-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`63.0.3+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`64.0+build3-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`65.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`65.0.1+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`66.0+build3-0ubuntu0.16.04.2`	vulnerable
Ubuntu	firefox	16.04	`66.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`66.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`66.0.3+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`66.0.4+build3-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`66.0.5+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`67.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`67.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`67.0.2+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`67.0.3+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`67.0.4+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`68.0+build3-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`68.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`68.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`69.0+build2-0ubuntu0.16.04.4`	vulnerable
Ubuntu	firefox	16.04	`69.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`69.0.2+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`70.0+build2-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`70.0.1+build1-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`71.0+build5-0ubuntu0.16.04.1`	vulnerable
Ubuntu	firefox	16.04	`72.0.1+build1-0ubuntu0.16.04.1`	fixed
Ubuntu	firefox	18.04	`56.0+build6-0ubuntu1`	vulnerable
Ubuntu	firefox	18.04	`57.0.1+build2-0ubuntu1`	vulnerable
Ubuntu	firefox	18.04	`59.0.1+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	18.04	`59.0.2+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	18.04	`60.0+build2-0ubuntu1`	vulnerable
Ubuntu	firefox	18.04	`60.0.1+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`60.0.2+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`61.0+build3-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`61.0.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`62.0+build2-0ubuntu0.18.04.3`	vulnerable
Ubuntu	firefox	18.04	`62.0+build2-0ubuntu0.18.04.4`	vulnerable
Ubuntu	firefox	18.04	`62.0+build2-0ubuntu0.18.04.5`	vulnerable
Ubuntu	firefox	18.04	`62.0.3+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`63.0+build2-0ubuntu0.18.04.2`	vulnerable
Ubuntu	firefox	18.04	`63.0.3+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`64.0+build3-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`65.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`65.0.1+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`66.0+build3-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`66.0.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`66.0.2+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`66.0.3+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`66.0.4+build3-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`66.0.5+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`67.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`67.0.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`67.0.2+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`67.0.3+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`67.0.4+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`68.0+build3-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`68.0.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`68.0.2+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`69.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`69.0.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`69.0.2+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`70.0+build2-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`70.0.1+build1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`71.0+build5-0ubuntu0.18.04.1`	vulnerable
Ubuntu	firefox	18.04	`72.0.1+build1-0ubuntu0.18.04.1`	fixed
Ubuntu	mozjs52	18.04	`52.3.1-0ubuntu3`	vulnerable
Ubuntu	mozjs52	18.04	`52.3.1-7fakesync1`	vulnerable
Ubuntu	mozjs52	18.04	`52.8.1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mozjs52	18.04	`52.9.1-0ubuntu0.18.04.1`	vulnerable
Ubuntu	mozjs38	18.04	`38.8.0~repack1-0ubuntu1`	vulnerable
Ubuntu	mozjs38	18.04	`38.8.0~repack1-0ubuntu3`	vulnerable
Ubuntu	mozjs38	18.04	`38.8.0~repack1-0ubuntu4`	vulnerable
Ubuntu	firefox	20.04	`69.0.3+build1-0ubuntu1`	vulnerable
Ubuntu	firefox	20.04	`70.0+build2-0ubuntu1`	vulnerable
Ubuntu	firefox	20.04	`70.0+build2-0ubuntu2`	vulnerable
Ubuntu	firefox	20.04	`70.0.1+build1-0ubuntu2`	vulnerable
Ubuntu	firefox	20.04	`71.0+build2-0ubuntu2`	vulnerable
Ubuntu	firefox	20.04	`71.0+build5-0ubuntu1`	vulnerable
Ubuntu	firefox	20.04	`72.0.1+build1-0ubuntu1`	fixed
Ubuntu	mozjs52	20.04	`52.9.1-1build1`	vulnerable
Ubuntu	mozjs52	20.04	`52.9.1-1ubuntu3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Ubuntu	firefox	deb	16.04	`72.0.1+build1-0ubuntu0.16.04.1`	Not reported	UBUNTU-CVE-2019-17020	Not reported
Ubuntu	firefox	deb	18.04	`72.0.1+build1-0ubuntu0.18.04.1`	Not reported	UBUNTU-CVE-2019-17020	Not reported
Ubuntu	firefox	deb	20.04	`72.0.1+build1-0ubuntu1`	Not reported	UBUNTU-CVE-2019-17020	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 5:41:39 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]