CVE-2018-5156

A vulnerability can occur when capturing a media stream when the media source type is changed as the capture is occurring. This can result in stream data being cast to the wrong type causing a potentially exploitable crash. This vulnerability affects Thunderbird < 60, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Mozilla: Memory safety bugs fixed in Firefox ESR 52.9 (CVE-2018-5188).

Mozilla: Buffer overflow using computed size of canvas element (CVE-2018-12359).

Mozilla: Use-after-free using focus() (CVE-2018-12360).

Mozilla: Media recorder segmentation fault when track type is changed during capture (CVE-2018-5156).

Mozilla: Integer overflow in SSSE3 scaler (CVE-2018-12362).

Mozilla: Use-after-free when appending DOM nodes (CVE-2018-12363).

Mozilla: CSRF attacks through 307 redirects and NPAPI plugins (CVE-2018-12364).

Mozilla: Compromised IPC child process can list local filenames (CVE-2018-12365).

Mozilla: Invalid data handling during QCMS transformations (CVE-2018-12366).

• Buffer overflow using computed size of canvas element. (CVE-2018-12359)

• Use-after-free when using focus(). (CVE-2018-12360)

• Integer overflow in SwizzleData. (CVE-2018-12361)

• Integer overflow in SSSE3 scaler. (CVE-2018-12362)

• Media recorder segmentation fault when track type is changed during capture. (CVE-2018-5156)

• Use-after-free when appending DOM nodes. (CVE-2018-12363)

• CSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)

• Compromised IPC child process can list local filenames. (CVE-2018-12365)

• Integer overflow in Skia library during edge builder allocation. (CVE-2018-12371)

• Invalid data handling during QCMS transformations. (CVE-2018-12366)

• Timing attack mitigation of PerformanceNavigationTiming. (CVE-2018-12367)

• No warning when opening executable SettingContent-ms files. (CVE-2018-12368)

• Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60. (CVE-2018-5187)

• Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60. (CVE-2018-5188)

• Use-after-free in refresh driver timers. (CVE-2018-12377)

• Use-after-free in IndexedDB. (CVE-2018-12378)

• Out-of-bounds write with malicious MAR file. (CVE-2018-12379)

• Proxy bypass using automount and autofs. (CVE-2017-16541)

• Crash in TransportSecurityInfo due to cached data. (CVE-2018-12385)

• Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords. (CVE-2018-12383)

• Memory safety bugs fixed in Firefox 62, Firefox ESR 60.2, and Thunderbird 60.2.1. (CVE-2018-12376)

• HTTP Live Stream audio data is accessible cross-origin. (CVE-2018-12391)

• Crash with nested event loops. (CVE-2018-12392)

• Integer overflow during Unicode conversion while loading JavaScript. (CVE-2018-12393)

• Memory safety bugs fixed in Firefox ESR 60.3 and Thunderbird 60.3. (CVE-2018-12389)

• Memory safety bugs fixed in Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3. (CVE-2018-12390)

This update for seamonkey fixes the following issues:

Mozilla Seamonkey was updated to 2.49.4:

Now uses Gecko 52.9.1esr (boo#1098998).

Security issues fixed with MFSA 2018-16 (boo#1098998):

• CVE-2018-12359: Buffer overflow using computed size of canvas element
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9

Localizations finally included again (boo#1062195)

Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with

Update to Seamonkey 2.49.2

• Gecko 52.6esr (including security relevant fixes) (boo#1077291)
• fix issue in Composer
• With some themes, the menulist- and history-dropmarker didn't show
• Scrollbars didn't show the buttons
• WebRTC has been disabled by default. It needs an add-on to enable it per site
• The active title bar was not visually emphasized

Correct requires and provides handling (boo#1076907)

This update was imported from the openSUSE:Leap:15.0:Update update project.

This update for Mozilla Thunderbird to version 60.2.1 fixes multiple issues.

Multiple security issues were fixed in the Mozilla platform as advised in MFSA 2018-25 and MFSA 2018-28. In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts:

• CVE-2018-12359: Prevent buffer overflow using computed size of canvas element (bsc#1098998)
• CVE-2018-12360: Prevent use-after-free when using focus() (bsc#1098998)
• CVE-2018-12361: Prevent integer overflow in SwizzleData (bsc#1098998)
• CVE-2018-12362: Prevent integer overflow in SSSE3 scaler (bsc#1098998)
• CVE-2018-5156: Prevent media recorder segmentation fault when track type is changed during capture (bsc#1098998)
• CVE-2018-12363: Prevent use-after-free when appending DOM nodes (bsc#1098998)
• CVE-2018-12364: Prevent CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998)
• CVE-2018-12365: Prevent compromised IPC child process listing local filenames (bsc#1098998)
• CVE-2018-12371: Prevent integer overflow in Skia library during edge builder allocation (bsc#1098998)
• CVE-2018-12366: Prevent invalid data handling during QCMS transformations (bsc#1098998)
• CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998)
• CVE-2018-5187: Various memory safety bugs (bsc#1098998)
• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343)
• CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343)
• CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1066489)
• CVE-2018-12376: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (bsc#1107343)
• CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (bsc#1109363)
• CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)
• CVE-2018-12389: Fixed memory safety bugs (bsc#1112852)
• CVE-2018-12390: Fixed memory safety bugs (bsc#1112852)
• CVE-2018-12391: Fixed HTTP Live Stream audio data is accessible cross-origin (bsc#1112852)
• CVE-2018-12392: Fixed crash with nested event loops (bsc#1112852)
• CVE-2018-12393: Fixed integer overflow during Unicode conversion while loading JavaScript (bsc#1112852)

These non-security issues were fixed:

• Fix date display issues (bsc#1109379)
• Fix start-up crash due to folder name with special characters (bsc#1107772)
• Storing of remote content settings fixed (bsc#1084603)
• Improved message handling and composing
• Improved handling of message templates
• Support for OAuth2 and FIDO U2F
• Various Calendar improvements
• Various fixes and changes to e-mail workflow
• Various IMAP fixes
• Native desktop notifications
• various theme fixes
• Shift+PageUp/PageDown in Write window
• Gloda attachment filtering
• Mailing list address auto-complete enter/return handling
• Thunderbird hung if HTML signature references non-existent image
• Filters not working for headers that appear more than once

These are all security issues fixed in the seamonkey-2.53.9.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues:

These security issues were fixed:

• Firefox ESR 52.9:

• CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998).

• CVE-2018-12368 No warning when opening executable SettingContent-ms files (bsc#1098998).

• CVE-2018-12366 Invalid data handling during QCMS transformations (bsc#1098998).

• CVE-2018-12365 Compromised IPC child process can list local filenames (bsc#1098998).

• CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).

• CVE-2018-12363 Use-after-free when appending DOM nodes (bsc#1098998).

• CVE-2018-12362 Integer overflow in SSSE3 scaler (bsc#1098998).

• CVE-2018-12360 Use-after-free when using focus() (bsc#1098998).

• CVE-2018-5156 Media recorder segmentation fault when track type is changed during capture (bsc#1098998).

• CVE-2018-12359 Buffer overflow using computed size of canvas element (bsc#1098998).

• Firefox ESR 52.8:

• CVE-2018-6126: Prevent heap buffer overflow in rasterizing paths in SVG with Skia (bsc#1096449).

• CVE-2018-5183: Backport critical security fixes in Skia (bsc#1092548).

• CVE-2018-5154: Use-after-free with SVG animations and clip paths (bsc#1092548).

• CVE-2018-5155: Use-after-free with SVG animations and text paths (bsc#1092548).

• CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files (bsc#1092548).

• CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer (bsc#1092548).

• CVE-2018-5159: Integer overflow and out-of-bounds write in Skia (bsc#1092548).

• CVE-2018-5168: Lightweight themes can be installed without user interaction (bsc#1092548).

• CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (bsc#1092548).

• CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (bsc#1092548).

These non-security issues were fixed:

• Various stability and regression fixes
• Performance improvements to the Safe Browsing service to avoid slowdowns while updating site classification data

This update for MozillaFirefox to version ESR 52.9 fixes the following issues:

• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12368: No warning when opening executable SettingContent-ms files
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12359: Buffer overflow using computed size of canvas element

This update for MozillaFirefox to version ESR 52.9 fixes the following issues:

• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12368: No warning when opening executable SettingContent-ms files
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12359: Buffer overflow using computed size of canvas element

This update for MozillaFirefox to version ESR 52.9 fixes the following issues:

• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12368: No warning when opening executable SettingContent-ms files
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12359: Buffer overflow using computed size of canvas element

This update for MozillaThunderbird to version 60.2.1 fixes the following issues:

Update to Thunderbird 60.2.1:

• Calendar: Default values for the first day of the week and working days are now derived from the selected datetime formatting locale
• Calendar: Switch to a Photon-style icon set for all platforms
• Fix multiple requests for master password when Google Mail or Calendar OAuth2 is enabled
• Fix scrollbar of the address entry auto-complete popup
• Fix security info dialog in compose window not showing certificate status
• Fix links in the Add-on Manager's search results and theme browsing tabs that opened in external browser
• Fix localization not showing the localized name for the 'Drafts' and 'Sent' folders for certain IMAP providers
• Fix replying to a message with an empty subject which inserted Re: twice
• Fix spellcheck marks disappeaing erroneously for words with an apostrophe
• Calendar: First day of the week can now be set
• Calendar: Several fixes related to cutting/deleting of events and email schedulin

These security issues were fixed:

• CVE-2018-12359: Prevent buffer overflow using computed size of canvas element (bsc#1098998).
• CVE-2018-12360: Prevent use-after-free when using focus() (bsc#1098998).
• CVE-2018-12361: Prevent integer overflow in SwizzleData (bsc#1098998).
• CVE-2018-12362: Prevent integer overflow in SSSE3 scaler (bsc#1098998).
• CVE-2018-5156: Prevent media recorder segmentation fault when track type is changed during capture (bsc#1098998).
• CVE-2018-12363: Prevent use-after-free when appending DOM nodes (bsc#1098998).
• CVE-2018-12364: Prevent CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).
• CVE-2018-12365: Prevent compromised IPC child process listing local filenames (bsc#1098998).
• CVE-2018-12371: Prevent integer overflow in Skia library during edge builder allocation (bsc#1098998).
• CVE-2018-12366: Prevent invalid data handling during QCMS transformations (bsc#1098998).
• CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming (bsc#1098998).
• CVE-2018-5187: Various memory safety bugs (bsc#1098998).
• CVE-2018-5188: Various memory safety bugs (bsc#1098998).
• CVE-2018-12377: Prevent use-after-free in refresh driver timers (bsc#1107343)
• CVE-2018-12378: Prevent use-after-free in IndexedDB (bsc#1107343)
• CVE-2017-16541: Prevent proxy bypass using automount and autofs (bsc#1066489)
• CVE-2018-12376: Fixed various memory safety bugs (bsc#1107343)
• CVE-2018-12385: Fixed crash in TransportSecurityInfo due to cached data (bsc#1109363)
• CVE-2018-12383: Fixed that setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)

These can not, in general, be exploited through email, but are potential risks in browser or browser-like contexts.

These non-security issues were fixed:

• Storing of remote content settings fixed (bsc#1084603)
• Improved message handling and composing
• Improved handling of message templates
• Support for OAuth2 and FIDO U2F
• Various Calendar improvements
• Various fixes and changes to e-mail workflow
• Various IMAP fixes
• Native desktop notifications
• Fix date display issues (bsc#1109379)
• Fix start-up crash due to folder name with special characters (bsc#1107772)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, bypass same-origin restrictions, bypass CORS restrictions, bypass CSRF protections, obtain sensitive information, or execute arbitrary code. (CVE-2018-5156, CVE-2018-5186, CVE-2018-5187, CVE-2018-5188, CVE-2018-12358, CVE-2018-12359, CVE-2018-12360, CVE-2018-12361, CVE-2018-12362, CVE-2018-12363, CVE-2018-12364, CVE-2018-12365, CVE-2018-12366, CVE-2018-12367, CVE-2018-12370, CVE-2018-12371)

A security issue was discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit this to obtain full browser permissions. (CVE-2018-12369)