CVE-2017-7805

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the application (CVE-2017-7805).

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823).

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.48 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399, CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404, CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410, CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414, CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426, CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421, CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433, CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439, CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444, CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449, CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459, CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465, CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472, CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753, CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758, CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765, CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779, CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787, CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800, CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805, CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818, CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826, CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)

Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)

• new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.override_list_reply_to allows to restore the previous behavior.
• Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use.
• IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko 52.4esr
• CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API
• CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array manipulation
• CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in design mode
• CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and validating elements with ANGLE
• CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free in TLS 1.2 generating handshake hashes
• CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and malware protection warnings
• CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render some Tibetan and Arabic unicode characters as spaces
• CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a unique origin
• CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

• Add alsa-devel BuildRequires: we care for ALSA support to be built and thus need to ensure we get the dependencies in place. In the past, alsa-devel was pulled in by accident: we buildrequire libgnome-devel. This required esound-devel and that in turn pulled in alsa-devel for us. libgnome is being fixed to no longer require esound-devel.

Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)

• new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.override_list_reply_to allows to restore the previous behavior.
• Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use.
• IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko 52.4esr
• CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API
• CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array manipulation
• CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in design mode
• CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and validating elements with ANGLE
• CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free in TLS 1.2 generating handshake hashes
• CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and malware protection warnings
• CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render some Tibetan and Arabic unicode characters as spaces
• CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a unique origin
• CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

• Add alsa-devel BuildRequires: we care for ALSA support to be built and thus need to ensure we get the dependencies in place. In the past, alsa-devel was pulled in by accident: we buildrequire libgnome-devel. This required esound-devel and that in turn pulled in alsa-devel for us. libgnome is being fixed to no longer require esound-devel.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to ESR 52.4, mozilla-nss fixes the following issues:

This security issue was fixed for mozilla-nss:

• CVE-2017-7805: Prevent use-after-free in TLS 1.2 when generating handshake hashes (bsc#1061005)

These security issues were fixed for Firefox

• CVE-2017-7825: Fixed some Tibetan and Arabic unicode characters rendering (bsc#1060445).
• CVE-2017-7805: Prevent Use-after-free in TLS 1.2 generating handshake hashes (bsc#1060445).
• CVE-2017-7819: Prevent Use-after-free while resizing images in design mode (bsc#1060445).
• CVE-2017-7818: Prevent Use-after-free during ARIA array manipulation (bsc#1060445).
• CVE-2017-7793: Prevent Use-after-free with Fetch API (bsc#1060445).
• CVE-2017-7824: Prevent Buffer overflow when drawing and validating elements with ANGLE (bsc#1060445).
• CVE-2017-7810: Fixed several memory safety bugs (bsc#1060445).
• CVE-2017-7823: CSP sandbox directive did not create a unique origin (bsc#1060445).
• CVE-2017-7814: Blob and data URLs bypassed phishing and malware protection warnings (bsc#1060445).

This update for MozillaFirefox and mozilla-nss fixes the following issues:

Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)

• MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
• MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode
• MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation
• MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API
• MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
• MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
• MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin
• MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

Mozilla Network Security Services (Mozilla NSS) received a security fix:

• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445)

This update for MozillaFirefox and mozilla-nss fixes the following issues:

Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)

• MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
• MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode
• MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation
• MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API
• MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
• MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
• MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin
• MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

Mozilla Network Security Services (Mozilla NSS) received a security fix:

• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445)

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)

Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to download and open non-executable files without interaction, or obtain elevated privileges. (CVE-2017-7816, CVE-2017-7821)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to read uninitialized memory, bypass phishing and malware protection, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7814, CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824)

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)