CVE-2017-7802

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due to a lack of strong references, a potentially exploitable crash may occur when the freed elements are accessed. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-7779, CVE-2017-7798, CVE-2017-7800, CVE-2017-7801, CVE-2017-7753, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7792, CVE-2017-7802, CVE-2017-7807, CVE-2017-7809, CVE-2017-7791, CVE-2017-7803).

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2017-7779, CVE-2017-7800, CVE-2017-7801, CVE-2017-7753, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7792, CVE-2017-7802, CVE-2017-7807, CVE-2017-7809, CVE-2017-7791, CVE-2017-7803).

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.48 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399, CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404, CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410, CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414, CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426, CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421, CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433, CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439, CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444, CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449, CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459, CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465, CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472, CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753, CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758, CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765, CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779, CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787, CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800, CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805, CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818, CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826, CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)

This update for MozillaThunderbird to version 52.3 fixes security issues and bugs.

The following vulnerabilities were fixed:

• CVE-2017-7798: XUL injection in the style editor in devtools
• CVE-2017-7800: Use-after-free in WebSockets during disconnection
• CVE-2017-7801: Use-after-free with marquee during window resizing
• CVE-2017-7784: Use-after-free with image observers
• CVE-2017-7802: Use-after-free resizing image elements
• CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM
• CVE-2017-7786: Buffer overflow while painting non-displayable SVG
• CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements#
• CVE-2017-7787: Same-origin policy bypass with iframes through page reloads
• CVE-2017-7807: Domain hijacking through AppCache fallback
• CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID
• CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher
• CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts
• CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections
• CVE-2017-7803: CSP containing 'sandbox' improperly applied
• CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3

The following bugs were fixed:

• Unwanted inline images shown in rogue SPAM messages
• Deleting message from the POP3 server not working when maildir storage was used
• Message disposition flag (replied / forwarded) lost when reply or forwarded message was stored as draft and draft was sent later
• Inline images not scaled to fit when printing
• Selected text from another message sometimes included in a reply
• No authorisation prompt displayed when inserting image into email body although image URL requires authentication
• Large attachments taking a long time to open under some circumstances

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Mozilla Firefox was updated to the ESR 52.3 release (bsc#1052829)

Following security issues were fixed:

• MFSA 2017-19/CVE-2017-7807: Domain hijacking through AppCache fallback
• MFSA 2017-19/CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts
• MFSA 2017-19/CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID
• MFSA 2017-19/CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections
• MFSA 2017-19/CVE-2017-7787: Same-origin policy bypass with iframes through page reloads
• MFSA 2017-19/CVE-2017-7786: Buffer overflow while painting non-displayable SVG
• MFSA 2017-19/CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM
• MFSA 2017-19/CVE-2017-7784: Use-after-free with image observers
• MFSA 2017-19/CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements
• MFSA 2017-19/CVE-2017-7798: XUL injection in the style editor in devtools
• MFSA 2017-19/CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher
• MFSA 2017-19/CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3
• MFSA 2017-19/CVE-2017-7800: Use-after-free in WebSockets during disconnection
• MFSA 2017-19/CVE-2017-7801: Use-after-free with marquee during window resizing
• MFSA 2017-19/CVE-2017-7802: Use-after-free resizing image elements
• MFSA 2017-19/CVE-2017-7803: CSP containing 'sandbox' improperly applied

This update also fixes:

• fixed firefox hangs after a while in FUTEX_WAIT_PRIVATE if cgroups enabled and running on cpu >=1 (bsc#1031485)
• The Itanium ia64 build was fixed.

This update for MozillaFirefox to ESR 52.3 fixes several issues.

These security issues were fixed:

• CVE-2017-7807 Domain hijacking through AppCache fallback (bsc#1052829)
• CVE-2017-7791 Spoofing following page navigation with data: protocol and modal alerts (bsc#1052829)
• CVE-2017-7792 Buffer overflow viewing certificates with an extremely long OID (bsc#1052829)
• CVE-2017-7782 WindowsDllDetourPatcher allocates memory without DEP protections (bsc#1052829)
• CVE-2017-7787 Same-origin policy bypass with iframes through page reloads (bsc#1052829)
• CVE-2017-7786 Buffer overflow while painting non-displayable SVG (bsc#1052829)
• CVE-2017-7785 Buffer overflow manipulating ARIA attributes in DOM (bsc#1052829)
• CVE-2017-7784 Use-after-free with image observers (bsc#1052829)
• CVE-2017-7753 Out-of-bounds read with cached style data and pseudo-elements (bsc#1052829)
• CVE-2017-7798 XUL injection in the style editor in devtools (bsc#1052829)
• CVE-2017-7804 Memory protection bypass through WindowsDllDetourPatcher (bsc#1052829)
• CVE-2017-7779 Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3 (bsc#1052829)
• CVE-2017-7800 Use-after-free in WebSockets during disconnection (bsc#1052829)
• CVE-2017-7801 Use-after-free with marquee during window resizing (bsc#1052829)
• CVE-2017-7802 Use-after-free resizing image elements (bsc#1052829)
• CVE-2017-7803 CSP containing 'sandbox' improperly applied (bsc#1052829)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to conduct cross-site scripting (XSS) attacks, bypass sandbox restrictions, obtain sensitive information, spoof the origin of modal alerts, bypass same origin restrictions, read uninitialized memory, cause a denial of service via program crash or hang, or execute arbitrary code. (CVE-2017-7753, CVE-2017-7779, CVE-2017-7780, CVE-2017-7781, CVE-2017-7783, CVE-2017-7784, CVE-2017-7785, CVE-2017-7786, CVE-2017-7787, CVE-2017-7788, CVE-2017-7789, CVE-2017-7791, CVE-2017-7792, CVE-2017-7794, CVE-2017-7797, CVE-2017-7798, CVE-2017-7799, CVE-2017-7800, CVE-2017-7801, CVE-2017-7802, CVE-2017-7803, CVE-2017-7806, CVE-2017-7807, CVE-2017-7808, CVE-2017-7809)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to bypass same-origin restrictions, bypass CSP restrictions, obtain sensitive information, spoof the origin of modal alerts, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7753, CVE-2017-7779, CVE-2017-7784, CVE-2017-7785, CVE-2017-7787, CVE-2017-7791, CVE-2017-7792, CVE-2017-7800, CVE-2017-7801, CVE-2017-7802, CVE-2017-7803, CVE-2017-7807, CVE-2017-7809)

A buffer overflow was discovered when displaying SVG content in some circumstances. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7786)