CVE-2016-5264

Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-2836, CVE-2016-5258, CVE-2016-5259, CVE-2016-5252, CVE-2016-5263, CVE-2016-2830, CVE-2016-2838, CVE-2016-5254, CVE-2016-5262, CVE-2016-5264, CVE-2016-5265, CVE-2016-2837).

This update for MozillaThunderbird fixes the following issues:

• update to Thunderbird 45.3.0 (boo#991809)

  • Disposition-Notification-To could not be used in mail.compose.other.header
  • 'edit as new message' on a received message pre-filled the sender as the composing identity.
  • Certain messages caused corruption of the drafts summary database. security fixes:
  • MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards
  • MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file

• Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

• add a screenshot to appdata.xml

This update for MozillaThunderbird fixes the following issues:

• update to Thunderbird 45.3.0 (boo#991809)

  • Disposition-Notification-To could not be used in mail.compose.other.header
  • 'edit as new message' on a received message pre-filled the sender as the composing identity.
  • Certain messages caused corruption of the drafts summary database. security fixes:
  • MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards
  • MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file

• Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

• add a screenshot to appdata.xml

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr and mozilla-nss were updated to fix nine security issues.

MozillaFirefox was updated to version 45.3.0 ESR. mozilla-nss was updated to version 3.21.1, mozilla-nspr to version 4.12.

These security issues were fixed in 45.3.0ESR:

• CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) (MFSA 2016-62)
• CVE-2016-2830: Favicon network connection can persist when page is closed (MFSA 2016-63)
• CVE-2016-2838: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64)
• CVE-2016-2839: Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 (MFSA 2016-65)
• CVE-2016-5252: Stack underflow during 2D graphics rendering (MFSA 2016-67)
• CVE-2016-5254: Use-after-free when using alt key and toplevel menus (MFSA 2016-70)
• CVE-2016-5258: Use-after-free in DTLS during WebRTC session shutdown (MFSA 2016-72)
• CVE-2016-5259: Use-after-free in service workers with nested sync events (MFSA 2016-73)
• CVE-2016-5262: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76)
• CVE-2016-2837: Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback (MFSA 2016-77)
• CVE-2016-5263: Type confusion in display transformation (MFSA 2016-78)
• CVE-2016-5264: Use-after-free when applying SVG effects (MFSA 2016-79)
• CVE-2016-5265: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Security issues fixed in 45.2.0.ESR:

• CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639).
• CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651).
• CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652).
• CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653).
• CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655).
• CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646).
• CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643).
• CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638)

These non-security issues were fixed:

• Fix crashes on aarch64
  • Determine page size at runtime (bsc#984006)
  • Allow aarch64 to work in safe mode (bsc#985659)
• Fix crashes on mainframes
• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

• MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
• MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
• MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
• MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
• MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
• MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
• MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
• MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
• MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
• MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
• MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
• MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
• MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added:

• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

• MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
• MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
• MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
• MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
• MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
• MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
• MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
• MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
• MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
• MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
• MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
• MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
• MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added:

• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

Gustavo Grieco discovered an out-of-bounds read during XML parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or obtain sensitive information. (CVE-2016-0718)

Toni Huttunen discovered that once a favicon is requested from a site, the remote server can keep the network connection open even after the page is closed. A remote attacked could potentially exploit this to track users, resulting in information disclosure. (CVE-2016-2830)

Christian Holler, Tyson Smith, Boris Zbarsky, Byron Campen, Julian Seward, Carsten Book, Gary Kwong, Jesse Ruderman, Andrew McCreight, and Phil Ringnalda discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2835, CVE-2016-2836)

A buffer overflow was discovered in the ClearKey Content Decryption Module (CDM) during video playback. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via plugin process crash, or, in combination with another vulnerability to escape the GMP sandbox, execute arbitrary code. (CVE-2016-2837)

Atte Kettunen discovered a buffer overflow when rendering SVG content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2838)

Bert Massop discovered a crash in Cairo with version 0.10 of FFmpeg. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-2839)

Catalin Dumitru discovered that URLs of resources loaded after a navigation start could be leaked to the following page via the Resource Timing API. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5250)

Firas Salem discovered an issue with non-ASCII and emoji characters in data: URLs. An attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-5251)

Georg Koppen discovered a stack buffer underflow during 2D graphics rendering in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5252)

Abhishek Arya discovered a use-after-free when the alt key is used with top-level menus. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5254)

Jukka Jylänki discovered a crash during garbage collection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code. (CVE-2016-5255)

Looben Yang discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5258)

Looben Yang discovered a use-after-free when working with nested sync events in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5259)

Mike Kaply discovered that plain-text passwords can be stored in session restore if an input field type is changed from "password" to "text" during a session, leading to information disclosure. (CVE-2016-5260)

Samuel Groß discovered an integer overflow in WebSockets during data buffering in some…