CVE-2018-5102

A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

A use-after-free vulnerability can occur when manipulating HTML media elements with media streams, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.6, Firefox ESR < 52.6, and Firefox < 58.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117).

To mitigate timing-based side-channel attacks similar to "Spectre" and "Meltdown", the resolution of performance.now() has been reduced from 5μs to 20μs.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117).

To mitigate timing-based side-channel attacks similar to "Spectre" and "Meltdown", the resolution of performance.now() has been reduced from 5μs to 20μs.

Integer overflow in Skia library during edge builder allocation. (CVE-2018-5095)

Use-after-free while editing form elements. (CVE-2018-5096)

Use-after-free when source document is manipulated during XSLT. (CVE-2018-5097)

Use-after-free while manipulating form input elements. (CVE-2018-5098)

Use-after-free with widget listener. (CVE-2018-5099)

Use-after-free in HTML media elements. (CVE-2018-5102)

Use-after-free during mouse event handling. (CVE-2018-5103)

Use-after-free during font face manipulation. (CVE-2018-5104)

URL spoofing with right-to-left text aligned left-to-right. (CVE-2018-5117)

Memory safety bugs fixed in Firefox 58, Firefox ESR 52.6, and Thunderbird 52.6. (CVE-2018-5089)

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.49.1 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117, CVE-2018-5125, CVE-2018-5127, CVE-2018-5129, CVE-2018-5130, CVE-2018-5131, CVE-2018-5144, CVE-2018-5145, CVE-2018-5148, CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178, CVE-2018-5183, CVE-2018-6126)

This update for MozillaThunderbird to version 52.6 fixes several issues.

These security issues were fixed:

• CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
• CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
• CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
• CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
• CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
• CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
• CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
• CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
• CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
• CVE-2018-5089: Various memory safety bugs (bsc#1077291).

These security issues were fixed:

• Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found.
• Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices
• Calendar: Unintended task deletion if numlock is enabled

This update for MozillaThunderbird to version 52.6 fixes several issues.

These security issues were fixed:

• CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
• CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
• CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
• CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
• CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
• CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
• CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
• CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
• CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
• CVE-2018-5089: Various memory safety bugs (bsc#1077291).

These security issues were fixed:

• Searching message bodies of messages in local folders, including filter and quick filter operations, not working reliably: Content not found in base64-encode message parts, non-ASCII text not found and false positives found.
• Defective messages (without at least one expected header) not shown in IMAP folders but shown on mobile devices
• Calendar: Unintended task deletion if numlock is enabled

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to version ESR 52.6 fixes several issues.

These security issues were fixed:

• CVE-2018-5091: Use-after-free with DTMF timers (bsc#1077291).
• CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
• CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
• CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
• CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
• CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
• CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
• CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).
• CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
• CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
• CVE-2018-5089: Various memory safety bugs (bsc#1077291).

This update for MozillaFirefox to version 52.6 several issues.

These security issues were fixed:

• CVE-2018-5091: Use-after-free with DTMF timers (bsc#1077291).
• CVE-2018-5095: Integer overflow in Skia library during edge builder allocation (bsc#1077291).
• CVE-2018-5096: Use-after-free while editing form elements (bsc#1077291).
• CVE-2018-5097: Use-after-free when source document is manipulated during XSLT (bsc#1077291).
• CVE-2018-5098: Use-after-free while manipulating form input elements (bsc#1077291).
• CVE-2018-5099: Use-after-free with widget listener (bsc#1077291).
• CVE-2018-5104: Use-after-free during font face manipulation (bsc#1077291).
• CVE-2018-5089: Fixed several memory safety bugs (bsc#1077291).
• CVE-2018-5117: URL spoofing with right-to-left text aligned left-to-right (bsc#1077291).
• CVE-2018-5102: Use-after-free in HTML media elements (bsc#1077291).
• CVE-2018-5103: Use-after-free during mouse event handling (bsc#1077291).

It was discovered that a From address encoded with a null character is cut off in the message header display. An attacker could potentially exploit this to spoof the sender address. (CVE-2017-7829)

It was discovered that it is possible to execute JavaScript in RSS feeds in some circumstances. If a user were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this in combination with another vulnerability, in order to cause unspecified problems. (CVE-2017-7846)

It was discovered that the RSS feed can leak local path names. If a user were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this to obtain sensitive information. (CVE-2017-7847)

It was discovered that RSS feeds are vulnerable to new line injection. If a user were tricked in to opening a specially crafted RSS feed, an attacker could potentially exploit this to cause unspecified problems. (CVE-2017-7848)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, execute arbitrary code, or cause other unspecified effects. (CVE-2018-5089, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, spoof the origin in audio capture prompts, trick the user in to providing HTTP credentials for another origin, spoof the addressbar contents, or execute arbitrary code. (CVE-2018-5089, CVE-2018-5090, CVE-2018-5091, CVE-2018-5092, CVE-2018-5093, CVE-2018-5094, CVE-2018-5095, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5100, CVE-2018-5101, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5109, CVE-2018-5114, CVE-2018-5115, CVE-2018-5117, CVE-2018-5122)

Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to gain additional privileges, bypass same-origin restrictions, or execute arbitrary code. (CVE-2018-5105, CVE-2018-5113, CVE-2018-5116)

A security issue was discovered with the developer tools. If a user were tricked in to opening a specially crafted website with the developer tools open, an attacker could potentially exploit this to obtain sensitive information from other origins. (CVE-2018-5106)

A security issue was discovered with printing. An attacker could potentially exploit this to obtain sensitive information from local files. (CVE-2018-5107)

It was discovered that manually entered blob URLs could be accessed by subsequent private browsing tabs. If a user were tricked in to entering a blob URL, an attacker could potentially exploit this to obtain sensitive information from a private browsing context. (CVE-2018-5108)

It was discovered that dragging certain specially formatted URLs to the addressbar could cause the wrong URL to be displayed. If a user were tricked in to opening a specially crafted website and dragging a URL to the addressbar, an attacker could potentially exploit this to spoof the addressbar contents. (CVE-2018-5111)

It was discovered that WebExtension developer tools panels could open non-relative URLs. If a user were tricked in to installing a specially crafted extension and running the developer tools, an attacker could potentially exploit this to gain additional privileges. (CVE-2018-5112)

It was discovered that ActivityStream images can attempt to load local content through file: URLs. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another vulnerability that allowed sandbox protections to be bypassed, in order to obtain sensitive information from local files. (CVE-2018-5118)

It was discovered that the reader view will load cross-origin content in violation of CORS headers. An attacker could exploit this to bypass CORS restrictions. (CVE-2018-5119)