CVE-2017-7830

The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830).

The updated packages fix several bugs and some security issues:

Use-after-free of PressShell while restyling layout. (CVE-2017-7828)

Cross-origin URL information leak through Resource Timing API. (CVE-2017-7830)

Memory safety bugs fixed in Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5. (CVE-2017-7826)

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.48 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399, CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404, CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410, CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414, CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426, CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421, CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433, CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439, CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444, CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449, CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459, CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465, CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472, CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753, CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758, CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765, CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779, CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787, CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800, CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805, CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818, CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826, CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)

This update for Mozilla Thunderbird fixes the following issues:

Security issues fixed in 52.5.0 ESR as advised in MFSA 2017-26 (boo#1068101):

• CVE-2017-7828: Use-after-free of PressShell while restyling layout
• CVE-2017-7830: Cross-origin URL information leak through Resource Timing API
• CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

The following bug fixes and improvements are included:

• Better support for Charter/Spectrum IMAP
• No longer mark other messages as read in search folders spanning multiple base folders
• IMAP alerts have been corrected and now show the correct server name in case of connection problems
• POP alerts have been corrected and now indicate connection problems in case the configured POP server cannot be found

This update for Mozilla Thunderbird fixes the following issues:

Security issues fixed in 52.5.0 ESR as advised in MFSA 2017-26 (boo#1068101):

• CVE-2017-7828: Use-after-free of PressShell while restyling layout
• CVE-2017-7830: Cross-origin URL information leak through Resource Timing API
• CVE-2017-7826: Memory safety bugs fixed in Firefox 57 and Firefox ESR 52.5

The following bug fixes and improvements are included:

• Better support for Charter/Spectrum IMAP
• No longer mark other messages as read in search folders spanning multiple base folders
• IMAP alerts have been corrected and now show the correct server name in case of connection problems
• POP alerts have been corrected and now indicate connection problems in case the configured POP server cannot be found

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox ESR 52.5 fixes the following issues:

Security issues fixed:

• CVE-2017-7826: Memory safety bugs fixed (bsc#1068101).
• CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101).
• CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101).

Mozilla Foundation Security Advisory (MFSA 2017-25):

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/

This update for MozillaFirefox ESR 52.5 fixes the following issues:

Security issues fixed:

• CVE-2017-7826: Memory safety bugs fixed (bsc#1068101).
• CVE-2017-7828: Use-after-free of PressShell while restyling layout (bsc#1068101).
• CVE-2017-7830: Cross-origin URL information leak through Resource Timing API (bsc#1068101).

Mozilla Foundation Security Advisory (MFSA 2017-25):

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, bypass same-origin restrictions, bypass CSP protections, bypass mixed content blocking, spoof the addressbar, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7827, CVE-2017-7828, CVE-2017-7830, CVE-2017-7831, CVE-2017-7832, CVE-2017-7833, CVE-2017-7834, CVE-2017-7835, CVE-2017-7837, CVE-2017-7838, CVE-2017-7842)

It was discovered that javascript: URLs pasted in to the addressbar would be executed instead of being blocked in some circumstances. If a user were tricked in to copying a specially crafted URL in to the addressbar, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2017-7839)

It was discovered that exported bookmarks do not strip script elements from user-supplied tags. If a user were tricked in to adding specially crafted tags to bookmarks, exporting them and then opening the resulting HTML file, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2017-7840)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to bypass same-origin restrictions, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7826, CVE-2017-7828, CVE-2017-7830)