CVE-2018-12392

When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling. This vulnerability affects Firefox < 63, Firefox ESR < 60.3, and Thunderbird < 60.3.

Updated firefox packages fix security vulnerabilities:

Mozilla: Memory safety bugs fixed in Firefox ESR 60.3 (CVE-2018-12389).

Mozilla: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3 (CVE-2018-12390).

Mozilla: Crash with nested event loops (CVE-2018-12392).

Mozilla: Integer overflow during Unicode conversion while loading JavaScript (CVE-2018-12393).

Mozilla: WebExtension bypass of domain restrictions through header rewriting (CVE-2018-12395).

Mozilla: WebExtension content scripts can execute in disallowed contexts (CVE-2018-12396).

Mozilla: WebExtension local file permission check bypass (CVE-2018-12397).

• Buffer overflow using computed size of canvas element. (CVE-2018-12359)

• Use-after-free when using focus(). (CVE-2018-12360)

• Integer overflow in SwizzleData. (CVE-2018-12361)

• Integer overflow in SSSE3 scaler. (CVE-2018-12362)

• Media recorder segmentation fault when track type is changed during capture. (CVE-2018-5156)

• Use-after-free when appending DOM nodes. (CVE-2018-12363)

• CSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)

• Compromised IPC child process can list local filenames. (CVE-2018-12365)

• Integer overflow in Skia library during edge builder allocation. (CVE-2018-12371)

• Invalid data handling during QCMS transformations. (CVE-2018-12366)

• Timing attack mitigation of PerformanceNavigationTiming. (CVE-2018-12367)

• No warning when opening executable SettingContent-ms files. (CVE-2018-12368)

• Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60. (CVE-2018-5187)

• Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60. (CVE-2018-5188)

• Use-after-free in refresh driver timers. (CVE-2018-12377)

• Use-after-free in IndexedDB. (CVE-2018-12378)

• Out-of-bounds write with malicious MAR file. (CVE-2018-12379)

• Proxy bypass using automount and autofs. (CVE-2017-16541)

• Crash in TransportSecurityInfo due to cached data. (CVE-2018-12385)

• Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords. (CVE-2018-12383)

• Memory safety bugs fixed in Firefox 62, Firefox ESR 60.2, and Thunderbird 60.2.1. (CVE-2018-12376)

• HTTP Live Stream audio data is accessible cross-origin. (CVE-2018-12391)

• Crash with nested event loops. (CVE-2018-12392)

• Integer overflow during Unicode conversion while loading JavaScript. (CVE-2018-12393)

• Memory safety bugs fixed in Firefox ESR 60.3 and Thunderbird 60.3. (CVE-2018-12389)

• Memory safety bugs fixed in Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3. (CVE-2018-12390)

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues.

Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts:

• CVE-2018-12359: Prevent buffer overflow using computed size of canvas element (bsc#1098998)
• CVE-2018-12360: Prevent use-after-free when using focus() (bsc#1098998)
• CVE-2018-12361: Prevent integer overflow in SwizzleData (bsc#1098998)
• CVE-2018-12362: Prevent integer overflow in SSSE3 scaler (bsc#1098998)
• CVE-2018-5156: Prevent media recorder segmentation fault when track type is changed during capture (bsc#1098998)
• CVE-2018-12363: Prevent use-after-free when appending DOM nodes (bsc#1098998)
• CVE-2018-12364: Prevent CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998)
• CVE-2018-12365: Prevent compromised IPC child process listing local filenames (bsc#1098998)
• CVE-2018-12371: Prevent integer overflow in Skia library during edge builder allocation (bsc#1098998)
• CVE-2018-12366: Prevent invalid data handling during QCMS transformations (bsc#1098998)
• CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998)
• CVE-2018-5187: Various memory safety bugs (bsc#1098998)
• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343)
• CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343)
• CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1066489)
• CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (bsc#1107343)
• CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (bsc#1109363)
• CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)
• CVE-2018-12389: Fixed memory safety bugs (bsc#1112852)
• CVE-2018-12390: Fixed memory safety bugs (bsc#1112852)
• CVE-2018-12391: Fixed HTTP Live Stream audio data is accessible cross-origin (bsc#1112852)
• CVE-2018-12392: Fixed crash with nested event loops (bsc#1112852)
• CVE-2018-12393: Fixed integer overflow during Unicode conversion while loading JavaScript (bsc#1112852)

These non-security issues were fixed:

• Fix date display issues (bsc#1109379)
• Fix start-up crash due to folder name with special characters (bsc#1107772)
• Storing of remote content settings fixed (bsc#1084603)
• Improved message handling and composing
• Improved handling of message templates
• Support for OAuth2 and FIDO U2F
• Various Calendar improvements
• Various fixes and changes to e-mail workflow
• Various IMAP fixes
• Native desktop notifications
• various theme fixes
• Shift+PageUp/PageDown in Write window
• Gloda attachment filtering
• Mailing list address auto-complete enter/return handling
• Thunderbird hung if HTML signature references non-existent image
• Filters not working for headers that appear more than once

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

• Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
• CVE-2018-12392: Crash with nested event loops.
• CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
• CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
• CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
• CVE-2018-12397: WebExtension local file access vulnerability.
• CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
• CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

• Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
• CVE-2018-12392: Crash with nested event loops.
• CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
• CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
• CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
• CVE-2018-12397: WebExtension local file access vulnerability.
• CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
• CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

• Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
• CVE-2018-12392: Crash with nested event loops.
• CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
• CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
• CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
• CVE-2018-12397: WebExtension local file access vulnerability.
• CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
• CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

• Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
• CVE-2018-12392: Crash with nested event loops.
• CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
• CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
• CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
• CVE-2018-12397: WebExtension local file access vulnerability.
• CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
• CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.

This update for MozillaThunderbird fixes the following issues:

Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues (bsc#1112852):

Security issues fixed (MFSA 2018-28):

• CVE-2018-12389: Fixed memory safety bugs.
• CVE-2018-12390: Fixed memory safety bugs.
• CVE-2018-12391: Fixed HTTP Live Stream audio data is accessible cross-origin.
• CVE-2018-12392: Fixed crash with nested event loops.
• CVE-2018-12393: Fixed integer overflow during Unicode conversion while loading JavaScript.

Non-security issues fixed:

• various theme fixes
• Shift+PageUp/PageDown in Write window
• Gloda attachment filtering
• Mailing list address auto-complete enter/return handling
• Thunderbird hung if HTML signature references non-existent image
• Filters not working for headers that appear more than once
• Update _constraints for armv6/7
• Add memory-constraints to avoid OOM errors

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass CSP restrictions, spoof the protocol registration notification bar, leak SameSite cookies, bypass mixed content warnings, or execute arbitrary code. (CVE-2018-12388, CVE-2018-12390, CVE-2018-12392, CVE-2018-12393, CVE-2018-12398, CVE-2018-12399, CVE-2018-12401, CVE-2018-12402, CVE-2018-12403)

Multiple security issues were discovered with WebExtensions in Firefox. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to bypass domain restrictions, gain additional privileges, or run content scripts in local pages without permission. (CVE-2018-12395, CVE-2018-12396, CVE-2018-12397)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same-origin restrictions, or execute arbitrary code.