CVE-2016-9079

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash (CVE-2016-5296).

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access (CVE-2016-5294).

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues (CVE-2016-5297).

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data (CVE-2016-9066).

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk (CVE-2016-5291).

Mozilla developers and community members Olli Pettay, Christian Holler, Ehsan Akhgari, Jon Coppeard, Gary Kwong, Tooru Fujisawa, Philipp, and Randell Jesup reported memory safety bugs present in Thunderbird ESR 45.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code (CVE-2016-5290).

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows (CVE-2016-9079).

A flaw was found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-9079).

This update for MozillaThunderbird fixes some potential security issues and bugs.

The following security flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts:

• CVE-2016-9079: SVG Animation Remote Code Execution (MFSA 2016-92, bsc#1012964)
• CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010411)
• CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)
• CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)
• CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)
• CVE-2016-5290: Memory safety bugs fixed in Thunderbird ESR 45.5 (bsc#1010427)

The update contains changes in behavior:

• Changed recipient address entry: Arrow-keys now copy the pop-up value to the input field. Mouse-hovered pop-up value can no longer be confirmed with tab or enter key. This restores the behavior of Thunderbird 24.
• Support changes to character limit in Twitter

The following bugs were fixed:

• Reply with selected text containing quote resulted in wrong quoting level indication
• Email invitation might not be displayed when description contains non-ASCII characters
• Attempting to sort messages on the Date field whilst a quick filter is applied got stuck on sort descending
• Mail address display at header pane displayed incorrectly if the address contains UTF-8 according to RFC 6532

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes security issues.

The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bbsc#1012964):

• CVE-2016-9079: Use-after-free in SVG Animation could be used for code execution (MFSA 2016-92 bsc#1012964)

This update for MozillaFirefox, mozilla-nss fixes security issues and bugs.

The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026 bsc#1012964):

• CVE-2016-9079: Use-after-free in SVG Animation (MFSA 2016-92 bsc#1012964)
• CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)
• CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)
• CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395)
• CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402)
• CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427)
• CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)

The following vulnerabilities were fixed in mozilla-nss 3.21.3:

• CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422)
• CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517)

The following bugs were fixed:

• Firefox would fail to go into fullscreen mode with some window managers (bsc#992549)
• font warning messages would flood console, now using fontconfig configuration from firefox-fontconfig instead of the system one (bsc#1000751)

This update for MozillaFirefox, mozilla-nss fixes security issues and bugs.

The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026):

• CVE-2016-9079: Use-after-free in SVG Animation (bsc#1012964 MFSA 2016-92)
• CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)
• CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)
• CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1 (bsc#1010395)
• CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402)
• CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427)
• CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)

The following vulnerabilities were fixed in mozilla-nss 3.21.3:

• CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422)
• CVE-2016-5285: Missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime causes server crash (bsc#1010517)

The following bugs were fixed:

• Firefox would fail to go into fullscreen mode with some window managers (bsc#992549)
• font warning messages would flood console, now using fontconfig configuration from firefox-fontconfig instead of the system one (bsc#1000751)

It was discovered that data: URLs can inherit the wrong origin after a HTTP redirect in some circumstances. An attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2016-9078)

A use-after-free was discovered in SVG animations. If a user were tricked in to opening a specially crafted website, an attacker could exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9079)

Christian Holler, Jon Coppeard, Olli Pettay, Ehsan Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5290)

A same-origin policy bypass was discovered with local HTML files in some circumstances. An attacker could potentially exploit this to obtain sensitive information. (CVE-2016-5291)

A heap buffer-overflow was discovered in Cairo when processing SVG content. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5296)

An error was discovered in argument length checking in Javascript. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-5297)

A buffer overflow was discovered in nsScriptLoadHandler. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9066)

A use-after-free was discovered in SVG animations. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-9079)