CVE-2017-7825

Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)

• new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.override_list_reply_to allows to restore the previous behavior.
• Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use.
• IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko 52.4esr
• CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API
• CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array manipulation
• CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in design mode
• CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and validating elements with ANGLE
• CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free in TLS 1.2 generating handshake hashes
• CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and malware protection warnings
• CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render some Tibetan and Arabic unicode characters as spaces
• CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a unique origin
• CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

• Add alsa-devel BuildRequires: we care for ALSA support to be built and thus need to ensure we get the dependencies in place. In the past, alsa-devel was pulled in by accident: we buildrequire libgnome-devel. This required esound-devel and that in turn pulled in alsa-devel for us. libgnome is being fixed to no longer require esound-devel.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to ESR 52.4, mozilla-nss fixes the following issues:

This security issue was fixed for mozilla-nss:

• CVE-2017-7805: Prevent use-after-free in TLS 1.2 when generating handshake hashes (bsc#1061005)

These security issues were fixed for Firefox

• CVE-2017-7825: Fixed some Tibetan and Arabic unicode characters rendering (bsc#1060445).
• CVE-2017-7805: Prevent Use-after-free in TLS 1.2 generating handshake hashes (bsc#1060445).
• CVE-2017-7819: Prevent Use-after-free while resizing images in design mode (bsc#1060445).
• CVE-2017-7818: Prevent Use-after-free during ARIA array manipulation (bsc#1060445).
• CVE-2017-7793: Prevent Use-after-free with Fetch API (bsc#1060445).
• CVE-2017-7824: Prevent Buffer overflow when drawing and validating elements with ANGLE (bsc#1060445).
• CVE-2017-7810: Fixed several memory safety bugs (bsc#1060445).
• CVE-2017-7823: CSP sandbox directive did not create a unique origin (bsc#1060445).
• CVE-2017-7814: Blob and data URLs bypassed phishing and malware protection warnings (bsc#1060445).

This update for MozillaFirefox and mozilla-nss fixes the following issues:

Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)

• MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
• MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode
• MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation
• MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API
• MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
• MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
• MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin
• MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

Mozilla Network Security Services (Mozilla NSS) received a security fix:

• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445)

This update for MozillaFirefox and mozilla-nss fixes the following issues:

Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)

• MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
• MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode
• MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation
• MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API
• MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
• MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
• MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin
• MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

Mozilla Network Security Services (Mozilla NSS) received a security fix:

• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445)