CVE-2016-5258

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-2836, CVE-2016-5258, CVE-2016-5259, CVE-2016-5252, CVE-2016-5263, CVE-2016-2830, CVE-2016-2838, CVE-2016-5254, CVE-2016-5262, CVE-2016-5264, CVE-2016-5265, CVE-2016-2837).

This update for MozillaThunderbird fixes the following issues:

• update to Thunderbird 45.3.0 (boo#991809)

  • Disposition-Notification-To could not be used in mail.compose.other.header
  • 'edit as new message' on a received message pre-filled the sender as the composing identity.
  • Certain messages caused corruption of the drafts summary database. security fixes:
  • MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards
  • MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file

• Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

• add a screenshot to appdata.xml

This update for MozillaThunderbird fixes the following issues:

• update to Thunderbird 45.3.0 (boo#991809)

  • Disposition-Notification-To could not be used in mail.compose.other.header
  • 'edit as new message' on a received message pre-filled the sender as the composing identity.
  • Certain messages caused corruption of the drafts summary database. security fixes:
  • MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards
  • MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file

• Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

• add a screenshot to appdata.xml

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr and mozilla-nss were updated to fix nine security issues.

MozillaFirefox was updated to version 45.3.0 ESR. mozilla-nss was updated to version 3.21.1, mozilla-nspr to version 4.12.

These security issues were fixed in 45.3.0ESR:

• CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) (MFSA 2016-62)
• CVE-2016-2830: Favicon network connection can persist when page is closed (MFSA 2016-63)
• CVE-2016-2838: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64)
• CVE-2016-2839: Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 (MFSA 2016-65)
• CVE-2016-5252: Stack underflow during 2D graphics rendering (MFSA 2016-67)
• CVE-2016-5254: Use-after-free when using alt key and toplevel menus (MFSA 2016-70)
• CVE-2016-5258: Use-after-free in DTLS during WebRTC session shutdown (MFSA 2016-72)
• CVE-2016-5259: Use-after-free in service workers with nested sync events (MFSA 2016-73)
• CVE-2016-5262: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76)
• CVE-2016-2837: Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback (MFSA 2016-77)
• CVE-2016-5263: Type confusion in display transformation (MFSA 2016-78)
• CVE-2016-5264: Use-after-free when applying SVG effects (MFSA 2016-79)
• CVE-2016-5265: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Security issues fixed in 45.2.0.ESR:

• CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639).
• CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651).
• CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652).
• CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653).
• CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655).
• CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646).
• CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643).
• CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638)

These non-security issues were fixed:

• Fix crashes on aarch64
  • Determine page size at runtime (bsc#984006)
  • Allow aarch64 to work in safe mode (bsc#985659)
• Fix crashes on mainframes
• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

• MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
• MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
• MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
• MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
• MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
• MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
• MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
• MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
• MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
• MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
• MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
• MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
• MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added:

• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

• MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
• MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
• MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
• MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
• MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
• MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
• MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
• MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
• MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
• MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
• MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
• MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
• MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added:

• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. (CVE-2016-0718)

Toni Huttunen discovered that once a favicon is requested from a site, the remote server can keep the network connection open even after the page is closed. A remote attacked could potentially exploit this to track users, resulting in information disclosure. (CVE-2016-2830)

Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, Julian Seward, Carsten Book, Gary Kwong, Jesse Ruderman, Andrew McCreight, and Phil Ringnalda discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2835, CVE-2016-2836)

A buffer overflow was discovered in the ClearKey Content Decryption Module (CDM) during video playback. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via plugin process crash, or, in combination with another vulnerability to escape the GMP sandbox, execute arbitrary code. (CVE-2016-2837)

Atte Kettunen discovered a buffer overflow when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2838)

Bert Massop discovered a crash in Cairo with version 0.10 of FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-2839)

Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5250)

Firas Salem discovered an issue with non-ASCII and emoji characters in data: URLs. An attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-5251)

Georg Koppen discovered a stack buffer underflow during 2D graphics rendering in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5252)

Abhishek Arya discovered a use-after-free when the alt key is used with top-level menus. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5254)

Jukka Jylänki discovered a crash during garbage collection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-5255)

Looben Yang discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5258)

Looben Yang discovered a use-after-free when working with nested sync events in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5259)

Mike Kaply discovered that plain-text passwords can be stored in session restore if an input field type is changed from "password" to "text" during a session, leading to information disclosure. (CVE-2016-5260)

Samuel Groß discovered an integer overflow in WebSockets during data buffering in some…