CVE-2016-6354

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or possibly execute arbitrary code via vectors involving num_to_read.

It was found that flex incorrectly resized the num_to_read variable in yy_get_next_buffer. The buffer is resized if this value is less or equal to zero. With special crafted input it is possible, that the buffer is not resized if the input is larger than the default buffer size of 16k. This allows a heap buffer overflow. It may be possible to exploit this remotely, depending on the application that is built using flex (CVE-2016-6354).

Note that any affected applications would need to be rebuilt with the updated flex to fully fix this issue.

This update for MozillaThunderbird fixes the following issues:

• update to Thunderbird 45.3.0 (boo#991809)

  • Disposition-Notification-To could not be used in mail.compose.other.header
  • 'edit as new message' on a received message pre-filled the sender as the composing identity.
  • Certain messages caused corruption of the drafts summary database. security fixes:
  • MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards
  • MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file

• Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

• add a screenshot to appdata.xml

This update for MozillaThunderbird fixes the following issues:

• update to Thunderbird 45.3.0 (boo#991809)

  • Disposition-Notification-To could not be used in mail.compose.other.header
  • 'edit as new message' on a received message pre-filled the sender as the composing identity.
  • Certain messages caused corruption of the drafts summary database. security fixes:
  • MFSA 2016-62/CVE-2016-2836 Miscellaneous memory safety hazards
  • MFSA 2016-63/CVE-2016-2830 (bmo#1255270) Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 (bmo#1279814) Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 (bmo#1275339) Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 (bmo#1268854) Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 (bmo#1266963) Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 (bmo#1279146) Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 (bmo#1282992) Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 (bmo#1277475) Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 (bmo#1274637) Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 (bmo#1276897) Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 (bmo#1286183) Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 (bmo#1278013) Same-origin policy violation using local HTML file and saved shortcut file

• Fix for possible buffer overrun (boo#990856) CVE-2016-6354 (bmo#1292534) [mozilla-flex_buffer_overrun.patch]

• add a screenshot to appdata.xml

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr and mozilla-nss were updated to fix nine security issues.

MozillaFirefox was updated to version 45.3.0 ESR. mozilla-nss was updated to version 3.21.1, mozilla-nspr to version 4.12.

These security issues were fixed in 45.3.0ESR:

• CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) (MFSA 2016-62)
• CVE-2016-2830: Favicon network connection can persist when page is closed (MFSA 2016-63)
• CVE-2016-2838: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64)
• CVE-2016-2839: Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 (MFSA 2016-65)
• CVE-2016-5252: Stack underflow during 2D graphics rendering (MFSA 2016-67)
• CVE-2016-5254: Use-after-free when using alt key and toplevel menus (MFSA 2016-70)
• CVE-2016-5258: Use-after-free in DTLS during WebRTC session shutdown (MFSA 2016-72)
• CVE-2016-5259: Use-after-free in service workers with nested sync events (MFSA 2016-73)
• CVE-2016-5262: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76)
• CVE-2016-2837: Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback (MFSA 2016-77)
• CVE-2016-5263: Type confusion in display transformation (MFSA 2016-78)
• CVE-2016-5264: Use-after-free when applying SVG effects (MFSA 2016-79)
• CVE-2016-5265: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Security issues fixed in 45.2.0.ESR:

• CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639).
• CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651).
• CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652).
• CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653).
• CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655).
• CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646).
• CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643).
• CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638)

These non-security issues were fixed:

• Fix crashes on aarch64
  • Determine page size at runtime (bsc#984006)
  • Allow aarch64 to work in safe mode (bsc#985659)
• Fix crashes on mainframes
• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

• MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
• MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
• MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
• MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
• MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
• MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
• MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
• MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
• MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
• MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
• MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
• MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
• MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added:

• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

• MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
• MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
• MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
• MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
• MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
• MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
• MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
• MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
• MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
• MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
• MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
• MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
• MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added:

• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

Various packages included vulnerable parsers generated by 'flex'.

This update provides a fixed 'flex' package and also rebuilds of packages that might have security issues caused by the auto generated code.

Flex itself was updated to fix a buffer overflow in the generated scanner (bsc#990856, CVE-2016-6354)

Packages that were rebuilt with the fixed flex:

• at
• bogofilter
• cyrus-imapd
• kdelibs4
• libQtWebKit4
• libbonobo
• mdbtools
• netpbm
• openslp
• sgmltool
• virtuoso

Also libqt5-qtwebkit received an additional security fix:

• CVE-2015-8079: QtWebKit logs visited URLs to WebpageIcons.db in private browsing mode (bsc#954210).

Wireshark was updated to version 2.2.6, which brings several new features, enhancements and bug fixes.

Thses security issues were fixed:

• CVE-2017-7700: In Wireshark the NetScaler file parser could go into an infinite loop, triggered by a malformed capture file. This was addressed in wiretap/netscaler.c by ensuring a nonzero record size (bsc#1033936)
• CVE-2017-7701: In Wireshark the BGP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-bgp.c by using a different integer data type (bsc#1033937)
• CVE-2017-7702: In Wireshark the WBXML dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wbxml.c by adding length validation (bsc#1033938)
• CVE-2017-7703: In Wireshark the IMAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-imap.c by calculating a line's end correctly (bsc#1033939)
• CVE-2017-7704: In Wireshark the DOF dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dof.c by using a different integer data type and adjusting a return value (bsc#1033940)
• CVE-2017-7705: In Wireshark the RPC over RDMA dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-rpcrdma.c by correctly checking for going beyond the maximum offset (bsc#1033941)
• CVE-2017-7745: In Wireshark the SIGCOMP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-sigcomp.c by correcting a memory-size check (bsc#1033942)
• CVE-2017-7746: In Wireshark the SLSK dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-slsk.c by adding checks for the remaining length (bsc#1033943)
• CVE-2017-7747: In Wireshark the PacketBB dissector could crash, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-packetbb.c by restricting additions to the protocol tree (bsc#1033944)
• CVE-2017-7748: In Wireshark the WSP dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-wsp.c by adding a length check (bsc#1033945)
• CVE-2017-6014: In Wireshark a crafted or malformed STANAG 4607 capture file will cause an infinite loop and memory exhaustion. If the packet size field in a packet header is null, the offset to read from will not advance, causing continuous attempts to read the same zero length packet. This will quickly exhaust all system memory (bsc#1025913)
• CVE-2017-5596: In Wireshark the ASTERIX dissector could go into an infinite loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-asterix.c by changing a data type to avoid an integer overflow (bsc#1021739)
• CVE-2017-5597: In Wireshark the DHCPv6 dissector could go into a large loop, triggered by packet injection or a malformed capture file. This was addressed in epan/dissectors/packet-dhcpv6.c by changing a data type to avoid an integer overflow (bsc#1021739)
• CVE-2016-9376: In Wireshark the OpenFlow dissector could crash with memory exhaustion, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-openflow_v5.c by ensuring that certain length values were sufficiently large (bsc#1010735)
• CVE-2016-9375: In Wireshark the DTN dissector could go into an infinite loop, triggered by network traffic or a capture file. This was addressed in epan/dissectors/packet-dtn.c by checking whether SDNV evaluation was successful (bsc#1010740)
• CVE-2016-9374: In Wireshark the…