CVE-2019-17005

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

The plain text serializer used a fixed-size array for the number of <ol> elements it could process; however it was possible to overflow the static-sized array leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Updated firefox packages fix security vulnerabilities:

Stack corruption due to incorrect number of arguments in WebRTC code. (CVE-2019-13722)

Buffer overflow in plain text serializer. (CVE-2019-17005)

Use-after-free in worker destruction. (CVE-2019-17008)

Updater temporary files accessible to unprivileged processes. (CVE-2019-17009)

Use-after-free when performing device orientation checks. (CVE-2019-17010)

Use-after-free when retrieving a document in antitracking. (CVE-2019-17011)

Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3. (CVE-2019-17012)

Updated thunderbird packages fix security vulnerabilities:

Stack corruption due to incorrect number of arguments in WebRTC code. (CVE-2019-13722)

Buffer overflow in plain text serializer. (CVE-2019-17005)

Use-after-free in worker destruction. (CVE-2019-17008)

Updater temporary files accessible to unprivileged processes. (CVE-2019-17009)

Use-after-free when performing device orientation checks. (CVE-2019-17010)

Use-after-free when retrieving a document in antitracking. (CVE-2019-17011)

Memory safety bugs fixed in Firefox 71, Firefox ESR 68.3, and Thunderbird 68.3. (CVE-2019-17012)

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Other issues addressed:

• New: Message display toolbar action WebExtension API (bmo#1531597)
• New: Navigation buttons are now available in content tabs (bmo#787683)
• Fixed an issue where write window was not always correct (bmo#1593280)
• Fixed toolbar issues (bmo#1584160)
• Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)
• Fixed an issue with scam link confirmation panel (bmo#1596413)
• Fixed an issue with the write window where the Link Properties dialog was not showing named anchors in context menu (bmo#1593629)
• Fixed issues with calendar (bmo#1588516)
• Fixed issues with chat where reordering via drag-and-drop was not working on Instant messaging status dialog (bmo#1591505)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:

Update Firefox Extended Support Release to 68.3.0 ESR (MFSA 2019-37 / bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Use-after-free in worker destruction (bmo#1546331).
• CVE-2019-13722: Stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156).
• CVE-2019-11745: Out of bounds write in NSS when encrypting with a block cipher (bmo#1586176).
• CVE-2019-17009: Updater temporary files accessible to unprivileged processes (bmo#1510494).
• CVE-2019-17010: Use-after-free when performing device orientation checks (bmo#1581084).
• CVE-2019-17005: Buffer overflow in plain text serializer (bmo#1584170).
• CVE-2019-17011: Use-after-free when retrieving a document in antitracking (bmo#1591334).
• CVE-2019-17012: Memory safety bugs fixed in Firefox 71 and Firefox ESR 68.3 (bmo#1449736, bmo#1533957, bmo#1560667, bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502).

Update mozilla-nss to version 3.47.1 (bsc#1158527):

Security issues fixed:

• CVE-2019-11745: EncryptUpdate should use maxout, not block size.

Bug fixes:

• Fix a crash that could be caused by client certificates during startup (bmo#1590495, bsc#1158527)
• Fix compile-time warnings from uninitialized variables in a perl script (bmo#1589810)
• Support AES HW acceleration on ARMv8 (bmo#1152625)
• Allow per-socket run-time ordering of the cipher suites presented in ClientHello (bmo#1267894)
• Add CMAC to FreeBL and PKCS #11 libraries (bmo#1570501)
• Remove arbitrary HKDF output limit by allocating space as needed (bmo#1577953)

Update mozilla-nspr to version 4.23:

Bug fixes:

• fixed a build failure that was introduced in 4.22
• correctness fix for Win64 socket polling
• whitespace in C files was cleaned up and no longer uses tab characters for indenting
• added support for the ARC architecture
• removed support for the following platforms: OSF1/Tru64, DGUX, IRIX, Symbian, BeOS
• correctness and build fixes

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 68.3esr (MFSA 2019-38 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Other issues addressed:

• New: Message display toolbar action WebExtension API (bmo#1531597)
• New: Navigation buttons are now available in content tabs (bmo#787683)
• Fixed an issue where write window was not always correct (bmo#1593280)
• Fixed toolbar issues (bmo#1584160)
• Fixed issues with LDAP lookup when SSL was enabled (bmo#1576364)
• Fixed an issue with scam link confirmation panel (bmo#1596413)
• Fixed an issue with the write window where the Link Properties dialog was not showing named anchors in context menu (bmo#1593629)
• Fixed issues with calendar (bmo#1588516)
• Fixed issues with chat where reordering via drag-and-drop was not working on Instant messaging status dialog (bmo#1591505)

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code.

USN-4216-1 fixed vulnerabilities in Firefox. This update provides the corresponding update for Ubuntu 16.04 LTS.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code.

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022, CVE-2019-17024, CVE-2019-17026)

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-11745)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11757, CVE-2019-11758, CVE-2019-11759, CVE-2019-11760, CVE-2019-11761, CVE-2019-11762, CVE-2019-11763, CVE-2019-11764, CVE-2019-17005, CVE-2019-17008, CVE-2019-17010, CVE-2019-17011, CVE-2019-17012, CVE-2019-17016, CVE-2019-17017, CVE-2019-17022, CVE-2019-17024, CVE-2019-17026, CVE-2019-20503, CVE-2020-6798, CVE-2020-6800, CVE-2020-6805, CVE-2020-6806, CVE-2020-6807, CVE-2020-6812, CVE-2020-6814, CVE-2020-6819, CVE-2020-6820, CVE-2020-6821, CVE-2020-6825)

It was discovered that NSS incorrectly handled certain memory operations. A remote attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-11745)

It was discovered that a specially crafted S/MIME message with an inner encryption layer could be displayed as having a valid signature in some circumstances, even if the signer had no access to the encrypted message. An attacker could potentially exploit this to spoof the message author. (CVE-2019-11755)

A heap overflow was discovered in the expat library in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-15903)

It was discovered that Message ID calculation was based on uninitialized data. An attacker could potentially exploit this to obtain sensitive information. (CVE-2020-6792)

Mutiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, or execute arbitrary code. (CVE-2020-6793, CVE-2020-6795, CVE-2020-6822)

It was discovered that if a user saved passwords before Thunderbird 60 and then later set a primary password, an unencrypted copy of these passwords would still be accessible. A local user could exploit this to obtain sensitive information. (CVE-2020-6794)

It was discovered that the Devtools’ ‘Copy as cURL’ feature did not fully escape website-controlled data. If a user were tricked in to using the ‘Copy as cURL’ feature to copy and paste a command with specially crafted data in to a terminal, an attacker could potentially exploit this to execute arbitrary commands via command injection. (CVE-2020-6811)