CVE-2019-5798

Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Updated thunderbird packages fixes bugs and security vulnerabilities:

Cross-origin theft of images with ImageBitmapRenderingContext. (CVE-2018-18511)

Out-of-bounds read in Skia. (CVE-2019-5798)

Use-after-free in png_image_free of libpng library. (CVE-2019-7317)

Cross-origin theft of images with createImageBitmap. (CVE-2019-9797)

Memory safety bugs fixed in Thunderbird 60.7. (CVE-2019-9800)

Type confusion with object groups and UnboxedObjects. (CVE-2019-9816)

Stealing of cross-domain images using canvas. (CVE-2019-9817)

Use-after-free in crash generation server. (CVE-2019-9818)

Compartment mismatch with fetch API. (CVE-2019-9819)

Use-after-free of ChromeEventHandler by DocShell. (CVE-2019-9820)

Use-after-free in XMLHttpRequest. (CVE-2019-11691)

Use-after-free removing listeners in the event listener manager. (CVE-2019-11692)

Buffer overflow in WebGL bufferdata on Linux. (CVE-2019-11693)

Theft of user history data through drag and drop of hyperlinks to and from bookmarks. (CVE-2019-11698)

Inline-PGP messages that allows an attacker to have Enigmail display a correctly signed or encrypted message info, but display a different unauthenticated text.

Updated firefox packages fix security vulnerabilities.

Cross-origin theft of images with ImageBitmapRenderingContext. (CVE-2018-18511)

Out-of-bounds read in Skia. (CVE-2019-5798)

Use-after-free in png_image_free of libpng library. (CVE-2019-7317)

Cross-origin theft of images with createImageBitmap. (CVE-2019-9797)

Memory safety bugs fixed in Firefox 67, Firefox ESR 60.7, and firefox 60.7. (CVE-2019-9800)

Type confusion with object groups and UnboxedObjects. (CVE-2019-9816)

Stealing of cross-domain images using canvas. (CVE-2019-9817)

Use-after-free in crash generation server. (CVE-2019-9818)

Compartment mismatch with fetch API. (CVE-2019-9819)

Use-after-free of ChromeEventHandler by DocShell. (CVE-2019-9820)

Use-after-free in XMLHttpRequest. (CVE-2019-11691)

Use-after-free removing listeners in the event listener manager. (CVE-2019-11692)

Buffer overflow in WebGL bufferdata on Linux. (CVE-2019-11693)

Theft of user history data through drag and drop of hyperlinks to and from bookmarks. (CVE-2019-11698)

This update for chromium to version 73.0.3683.75 fixes the following issues:

Security issues fixed (bsc#1129059):

• CVE-2019-5787: Fixed a use after free in Canvas.
• CVE-2019-5788: Fixed a use after free in FileAPI.
• CVE-2019-5789: Fixed a use after free in WebMIDI.
• CVE-2019-5790: Fixed a heap buffer overflow in V8.
• CVE-2019-5791: Fixed a type confusion in V8.
• CVE-2019-5792: Fixed an integer overflow in PDFium.
• CVE-2019-5793: Fixed excessive permissions for private API in Extensions.
• CVE-2019-5794: Fixed security UI spoofing.
• CVE-2019-5795: Fixed an integer overflow in PDFium.
• CVE-2019-5796: Fixed a race condition in Extensions.
• CVE-2019-5797: Fixed a race condition in DOMStorage.
• CVE-2019-5798: Fixed an out of bounds read in Skia.
• CVE-2019-5799: Fixed a CSP bypass with blob URL.
• CVE-2019-5800: Fixed a CSP bypass with blob URL.
• CVE-2019-5801: Fixed an incorrect Omnibox display on iOS.
• CVE-2019-5802: Fixed security UI spoofing.
• CVE-2019-5803: Fixed a CSP bypass with Javascript URLs'.
• CVE-2019-5804: Fixed a command line injection on Windows.

Release notes: https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to 60.7.0esr (boo#1135824 MFSA 2019-14):

• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
• CVE-2019-11691: Use-after-free in XMLHttpRequest
• CVE-2019-11692: Use-after-free removing listeners in the event listener manager
• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
• CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox
• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
• CVE-2019-5798: Out-of-bounds read in Skia
• CVE-2019-7317: Use-after-free in png_image_free of libpng library
• CVE-2019-9797: Cross-origin theft of images with createImageBitmap
• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
• CVE-2019-9816: Type confusion with object groups and UnboxedObjects
• CVE-2019-9817: Stealing of cross-domain images using canvas
• CVE-2019-9818: (Windows only) Use-after-free in crash generation server
• CVE-2019-9819: Compartment mismatch with fetch API
• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
• CVE-2019-9821: Use-after-free in AssertWorkerThread

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872):

• CVE-2019-11707: Type confusion in Array.pop
• CVE-2019-11708: sandbox escape using Prompt:Open

Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595):

• CVE-2019-11703: Heap buffer overflow in icalparser.c
• CVE-2019-11704: Heap buffer overflow in icalvalue.c
• CVE-2019-11705: Stack buffer overflow in icalrecur.c
• CVE-2019-11706: Type confusion in icalproperty.c

Also fixed: No prompt for smartcard PIN when S/MIME signing is used

Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824):

• Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

• CVE-2019-9816: Type confusion with object groups and UnboxedObjects

• CVE-2019-9817: Stealing of cross-domain images using canvas

• CVE-2019-9818 (Windows only): Use-after-free in crash generation server

• CVE-2019-9819: Compartment mismatch with fetch API

• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

• CVE-2019-11691: Use-after-free in XMLHttpRequest

• CVE-2019-11692: Use-after-free removing listeners in the event listener manager

• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

• CVE-2019-7317: Use-after-free in png_image_free of libpng library

• CVE-2019-9797: Cross-origin theft of images with createImageBitmap

• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext

• CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

• CVE-2019-5798: Out-of-bounds read in Skia

• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

• Disable building with LTO (boo#1133267).

This update for chromium fixes the following issues:

Chromium was updated to 75.0.3770.90 (boo#1137332 boo#1138287):

• CVE-2019-5842: Use-after-free in Blink.

Also updated to 75.0.3770.80 boo#1137332:

• CVE-2019-5828: Use after free in ServiceWorker
• CVE-2019-5829: Use after free in Download Manager
• CVE-2019-5830: Incorrectly credentialed requests in CORS
• CVE-2019-5831: Incorrect map processing in V8
• CVE-2019-5832: Incorrect CORS handling in XHR
• CVE-2019-5833: Inconsistent security UI placemen
• CVE-2019-5835: Out of bounds read in Swiftshader
• CVE-2019-5836: Heap buffer overflow in Angle
• CVE-2019-5837: Cross-origin resources size disclosure in Appcache
• CVE-2019-5838: Overly permissive tab access in Extensions
• CVE-2019-5839: Incorrect handling of certain code points in Blink
• CVE-2019-5840: Popup blocker bypass
• Various fixes from internal audits, fuzzing and other initiatives
• CVE-2019-5834: URL spoof in Omnibox on iOS

Update to 74.0.3729.169:

• Feature fixes update only

Update to 74.0.3729.157:

• Various security fixes from internal audits, fuzzing and other initiatives

Includes security fixes from 74.0.3729.131 (boo#1134218):

• CVE-2019-5827: Out-of-bounds access in SQLite
• CVE-2019-5824: Parameter passing error in media player

Update to 74.0.3729.108 boo#1133313:

• CVE-2019-5805: Use after free in PDFium
• CVE-2019-5806: Integer overflow in Angle
• CVE-2019-5807: Memory corruption in V8
• CVE-2019-5808: Use after free in Blink
• CVE-2019-5809: Use after free in Blink
• CVE-2019-5810: User information disclosure in Autofill
• CVE-2019-5811: CORS bypass in Blink
• CVE-2019-5813: Out of bounds read in V8
• CVE-2019-5814: CORS bypass in Blink
• CVE-2019-5815: Heap buffer overflow in Blink
• CVE-2019-5818: Uninitialized value in media reader
• CVE-2019-5819: Incorrect escaping in developer tools
• CVE-2019-5820: Integer overflow in PDFium
• CVE-2019-5821: Integer overflow in PDFium
• CVE-2019-5822: CORS bypass in download manager
• CVE-2019-5823: Forced navigation from service worker
• CVE-2019-5812: URL spoof in Omnibox on iOS
• CVE-2019-5816: Exploit persistence extension on Android
• CVE-2019-5817: Heap buffer overflow in Angle on Windows

Update to 73.0.3686.103:

• Various feature fixes

Update to 73.0.3683.86:

• Just feature fixes around

• Update conditions to use system harfbuzz on TW+
• Require java during build
• Enable using pipewire when available
• Rebase chromium-vaapi.patch to match up the Fedora one

Update to 73.0.3683.75 boo#1129059:

• CVE-2019-5787: Use after free in Canvas.
• CVE-2019-5788: Use after free in FileAPI.
• CVE-2019-5789: Use after free in WebMIDI.
• CVE-2019-5790: Heap buffer overflow in V8.
• CVE-2019-5791: Type confusion in V8.
• CVE-2019-5792: Integer overflow in PDFium.
• CVE-2019-5793: Excessive permissions for private API in Extensions.
• CVE-2019-5794: Security UI spoofing.
• CVE-2019-5795: Integer overflow in PDFium.
• CVE-2019-5796: Race condition in Extensions.
• CVE-2019-5797: Race condition in DOMStorage.
• CVE-2019-5798: Out of bounds read in Skia.
• CVE-2019-5799: CSP bypass with blob URL.
• CVE-2019-5800: CSP bypass with blob URL.
• CVE-2019-5801: Incorrect Omnibox display on iOS.
• CVE-2019-5802: Security UI spoofing.
• CVE-2019-5803: CSP bypass with Javascript URLs'.
• CVE-2019-5804: Command line command injection on Windows.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.0.

• Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

These security issues were fixed (MFSA 2019-15 bsc#1135824):

• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
• CVE-2019-9816: Type confusion with object groups and UnboxedObjects
• CVE-2019-9817: Stealing of cross-domain images using canvas
• CVE-2019-9818: Use-after-free in crash generation server
• CVE-2019-9819: Compartment mismatch with fetch API
• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
• CVE-2019-11691: Use-after-free in XMLHttpRequest
• CVE-2019-11692: Use-after-free removing listeners in the event listener manager
• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
• CVE-2019-7317: Use-after-free in png_image_free of libpng library
• CVE-2019-9797: Cross-origin theft of images with createImageBitmap
• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
• CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox
• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
• CVE-2019-5798: Out-of-bounds read in Skia
• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same-origin protections, or execute arbitrary code. (CVE-2019-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2019-5798, CVE-2019-7317)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website in a browsing context after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to a bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)