CVE-2018-5150

Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

Updated firefox packages fix security vulnerabilities:

Mozilla: Memory safety bugs fixed in Firefox ESR 52.8 (CVE-2018-5150).

Mozilla: Backport critical security fixes in Skia (CVE-2018-5183).

Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154).

Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155).

Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157).

Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158).

Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159).

Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168).

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178).

Rootcerts has been updated to 20180411.

Updated thunderbird packages fix security vulnerabilities:

Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150).

Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154).

Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155).

Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159).

Mozilla: Hang via malformed headers (CVE-2018-5161).

Mozilla: Encrypted mail leaks plaintext through src attribute (CVE-2018-5162).

Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168).

Mozilla: Filename spoofing for external attachments (CVE-2018-5170).

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178).

Mozilla: Backport critical security fixes in Skia (CVE-2018-5183).

Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack (CVE-2018-5184).

Mozilla: Leaking plaintext through HTML forms (CVE-2018-5185).

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.49.1 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117, CVE-2018-5125, CVE-2018-5127, CVE-2018-5129, CVE-2018-5130, CVE-2018-5131, CVE-2018-5144, CVE-2018-5145, CVE-2018-5148, CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178, CVE-2018-5183, CVE-2018-6126)

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to ESR 52.8 release fixes the following issues:

Update to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed:

• MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
• MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
• MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction
• MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
• MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths
• MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia
• MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
• MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths
• MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

This update for MozillaFirefox to the ESR 52.8 release fixes the following issues:

Mozil to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed:

• MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
• MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
• MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction
• MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
• MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths
• MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia
• MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
• MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths
• MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

This update for MozillaFirefox to the ESR 52.8 release fixes the following issues:

Mozil to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed:

• MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
• MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
• MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction
• MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
• MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths
• MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia
• MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
• MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths
• MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues:

These security issues were fixed:

• Firefox ESR 52.9:

• CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998).

• CVE-2018-12368 No warning when opening executable SettingContent-ms files (bsc#1098998).

• CVE-2018-12366 Invalid data handling during QCMS transformations (bsc#1098998).

• CVE-2018-12365 Compromised IPC child process can list local filenames (bsc#1098998).

• CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).

• CVE-2018-12363 Use-after-free when appending DOM nodes (bsc#1098998).

• CVE-2018-12362 Integer overflow in SSSE3 scaler (bsc#1098998).

• CVE-2018-12360 Use-after-free when using focus() (bsc#1098998).

• CVE-2018-5156 Media recorder segmentation fault when track type is changed during capture (bsc#1098998).

• CVE-2018-12359 Buffer overflow using computed size of canvas element (bsc#1098998).

• Firefox ESR 52.8:

• CVE-2018-6126: Prevent heap buffer overflow in rasterizing paths in SVG with Skia (bsc#1096449).

• CVE-2018-5183: Backport critical security fixes in Skia (bsc#1092548).

• CVE-2018-5154: Use-after-free with SVG animations and clip paths (bsc#1092548).

• CVE-2018-5155: Use-after-free with SVG animations and text paths (bsc#1092548).

• CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files (bsc#1092548).

• CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer (bsc#1092548).

• CVE-2018-5159: Integer overflow and out-of-bounds write in Skia (bsc#1092548).

• CVE-2018-5168: Lightweight themes can be installed without user interaction (bsc#1092548).

• CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (bsc#1092548).

• CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (bsc#1092548).

These non-security issues were fixed:

• Various stability and regression fixes
• Performance improvements to the Safe Browsing service to avoid slowdowns while updating site classification data

This update for MozillaFirefox to 68.2.0 ESR fixes the following issues:

Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).

Security issues fixed:

• CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
• CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
• CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
• CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
• CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
• CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).
• CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).
• CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).
• CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed:

• Firefox 60.7 ESR changed the user interface language (bsc#1137990).
• Wrong Firefox GUI Language (bsc#1120374).
• Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).
• Firefox hangs randomly when browsing and scrolling (bsc#1043008).
• Firefox stops loading page until mouse is moved (bsc#1025108).

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175, CVE-2018-5177, CVE-2018-5180)

Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information, or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166)

It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167)

It was discovered that dragging and dropping link text on to the home button could set the home page to include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to the home button, an attacker could potentially exploit this bypass security restrictions. (CVE-2018-5169)

It was discovered that the Live Bookmarks page and PDF viewer would run script pasted from the clipboard. If a user were tricked in to copying and pasting specially crafted text, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5172)

It was discovered that the JSON viewer incorrectly linkified javascript: URLs. If a user were tricked in to clicking on a specially crafted link, an attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5176)

It was discovered that dragging a file: URL on to a tab that is running in a different process would cause the file to open in that process. If a user were tricked in to dragging a file: URL, an attacker could potentially exploit this to bypass intended security policies. (CVE-2018-5181)

It was discovered that dragging text that is a file: URL on to the addressbar would open the specified file. If a user were tricked in to dragging specially crafted text on to the addressbar, an attacker could potentially exploit this to bypass intended security policies. (CVE-2018-5182)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service via application crash, install lightweight themes without user interaction, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178)

An issue was discovered when processing message headers in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application hang. (CVE-2018-5161)

It was discovered encrypted messages could leak plaintext via the src attribute of remote images or links. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5162)

It was discovered that the filename of an attachment could be spoofed. An attacker could potentially exploit this by tricking the user in to opening an attachment of a different type to the one expected. (CVE-2018-5170)

Multiple security issues were discovered in Skia. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2018-5183)

It was discovered that S/MIME encrypted messages with remote content could leak plaintext via a chosen-ciphertext attack. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5184)

It was discovered that plaintext of decrypted emails could leak by submitting an embedded form. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5185)

Multiple memory safety issues were fixed in Spidermonkey. An attacker could potentially exploit these to cause a denial of service, or execute arbitrary code.