CVE-2018-5168

Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element. This could allow a malicious site to install a theme without user interaction which could contain offensive or embarrassing images. This vulnerability affects Thunderbird < 52.8, Thunderbird ESR < 52.8, Firefox < 60, and Firefox ESR < 52.8.

Updated firefox packages fix security vulnerabilities:

Mozilla: Memory safety bugs fixed in Firefox ESR 52.8 (CVE-2018-5150).

Mozilla: Backport critical security fixes in Skia (CVE-2018-5183).

Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154).

Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155).

Mozilla: Same-origin bypass of PDF Viewer to view protected PDF files (CVE-2018-5157).

Mozilla: Malicious PDF can inject JavaScript into PDF Viewer (CVE-2018-5158).

Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159).

Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168).

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178).

Rootcerts has been updated to 20180411.

Updated thunderbird packages fix security vulnerabilities:

Mozilla: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (CVE-2018-5150).

Mozilla: Use-after-free with SVG animations and clip paths (CVE-2018-5154).

Mozilla: Use-after-free with SVG animations and text paths (CVE-2018-5155).

Mozilla: Integer overflow and out-of-bounds write in Skia (CVE-2018-5159).

Mozilla: Hang via malformed headers (CVE-2018-5161).

Mozilla: Encrypted mail leaks plaintext through src attribute (CVE-2018-5162).

Mozilla: Lightweight themes can be installed without user interaction (CVE-2018-5168).

Mozilla: Filename spoofing for external attachments (CVE-2018-5170).

Mozilla: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (CVE-2018-5178).

Mozilla: Backport critical security fixes in Skia (CVE-2018-5183).

Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack (CVE-2018-5184).

Mozilla: Leaking plaintext through HTML forms (CVE-2018-5185).

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.49.1 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117, CVE-2018-5125, CVE-2018-5127, CVE-2018-5129, CVE-2018-5130, CVE-2018-5131, CVE-2018-5144, CVE-2018-5145, CVE-2018-5148, CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178, CVE-2018-5183, CVE-2018-6126)

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to ESR 52.8 release fixes the following issues:

Update to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed:

• MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
• MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
• MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction
• MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
• MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths
• MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia
• MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
• MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths
• MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

This update for MozillaFirefox to the ESR 52.8 release fixes the following issues:

Mozil to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed:

• MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
• MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
• MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction
• MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
• MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths
• MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia
• MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
• MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths
• MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

This update for MozillaFirefox to the ESR 52.8 release fixes the following issues:

Mozil to Firefox ESR 52.8 (bsc#1092548)

Security issues fixed:

• MFSA 2018-12/CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
• MFSA 2018-12/CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
• MFSA 2018-12/CVE-2018-5168: Lightweight themes can be installed without user interaction
• MFSA 2018-12/CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
• MFSA 2018-12/CVE-2018-5155: Use-after-free with SVG animations and text paths
• MFSA 2018-12/CVE-2018-5183: Backport critical security fixes in Skia
• MFSA 2018-12/CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
• MFSA 2018-12/CVE-2018-5154: Use-after-free with SVG animations and clip paths
• MFSA 2018-12/CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues:

These security issues were fixed:

• Firefox ESR 52.9:

• CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998).

• CVE-2018-12368 No warning when opening executable SettingContent-ms files (bsc#1098998).

• CVE-2018-12366 Invalid data handling during QCMS transformations (bsc#1098998).

• CVE-2018-12365 Compromised IPC child process can list local filenames (bsc#1098998).

• CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).

• CVE-2018-12363 Use-after-free when appending DOM nodes (bsc#1098998).

• CVE-2018-12362 Integer overflow in SSSE3 scaler (bsc#1098998).

• CVE-2018-12360 Use-after-free when using focus() (bsc#1098998).

• CVE-2018-5156 Media recorder segmentation fault when track type is changed during capture (bsc#1098998).

• CVE-2018-12359 Buffer overflow using computed size of canvas element (bsc#1098998).

• Firefox ESR 52.8:

• CVE-2018-6126: Prevent heap buffer overflow in rasterizing paths in SVG with Skia (bsc#1096449).

• CVE-2018-5183: Backport critical security fixes in Skia (bsc#1092548).

• CVE-2018-5154: Use-after-free with SVG animations and clip paths (bsc#1092548).

• CVE-2018-5155: Use-after-free with SVG animations and text paths (bsc#1092548).

• CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files (bsc#1092548).

• CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer (bsc#1092548).

• CVE-2018-5159: Integer overflow and out-of-bounds write in Skia (bsc#1092548).

• CVE-2018-5168: Lightweight themes can be installed without user interaction (bsc#1092548).

• CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (bsc#1092548).

• CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (bsc#1092548).

These non-security issues were fixed:

• Various stability and regression fixes
• Performance improvements to the Safe Browsing service to avoid slowdowns while updating site classification data

This update for MozillaFirefox to 68.2.0 ESR fixes the following issues:

Mozilla Firefox was updated to version 68.2.0 ESR (bsc#1154738).

Security issues fixed:

• CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
• CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
• CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
• CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
• CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
• CVE-2019-11761: Fixed an unintended access to a privileged JSONView object (bsc#1154738).
• CVE-2019-11762: Fixed a same-origin-property violation (bsc#1154738).
• CVE-2019-11763: Fixed an XSS bypass (bsc#1154738).
• CVE-2019-11764: Fixed several memory safety bugs (bsc#1154738).

Non-security issues fixed:

• Firefox 60.7 ESR changed the user interface language (bsc#1137990).
• Wrong Firefox GUI Language (bsc#1120374).
• Fixed an inadvertent crash report transmission without user opt-in (bsc#1074235).
• Firefox hangs randomly when browsing and scrolling (bsc#1043008).
• Firefox stops loading page until mouse is moved (bsc#1025108).

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, install lightweight themes without user interaction, spoof the filename in the downloads panel, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5151, CVE-2018-5153, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5160, CVE-2018-5163, CVE-2018-5164, CVE-2018-5168, CVE-2018-5173, CVE-2018-5175, CVE-2018-5177, CVE-2018-5180)

Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information, or bypass security restrictions. (CVE-2018-5152, CVE-2018-5166)

It was discovered that the web console and JavaScript debugger incorrectly linkified chrome: and javascript URLs. If a user were tricked in to clicking a specially crafted link, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5167)

It was discovered that dragging and dropping link text on to the home button could set the home page to include chrome pages. If a user were tricked in to dragging and dropping a specially crafted link on to the home button, an attacker could potentially exploit this bypass security restrictions. (CVE-2018-5169)

It was discovered that the Live Bookmarks page and PDF viewer would run script pasted from the clipboard. If a user were tricked in to copying and pasting specially crafted text, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5172)

It was discovered that the JSON viewer incorrectly linkified javascript: URLs. If a user were tricked in to clicking on a specially crafted link, an attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5176)

It was discovered that dragging a file: URL on to a tab that is running in a different process would cause the file to open in that process. If a user were tricked in to dragging a file: URL, an attacker could potentially exploit this to bypass intended security policies. (CVE-2018-5181)

It was discovered that dragging text that is a file: URL on to the addressbar would open the specified file. If a user were tricked in to dragging specially crafted text on to the addressbar, an attacker could potentially exploit this to bypass intended security policies. (CVE-2018-5182)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service via application crash, install lightweight themes without user interaction, or execute arbitrary code. (CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178)

An issue was discovered when processing message headers in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application hang. (CVE-2018-5161)

It was discovered encrypted messages could leak plaintext via the src attribute of remote images or links. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5162)

It was discovered that the filename of an attachment could be spoofed. An attacker could potentially exploit this by tricking the user in to opening an attachment of a different type to the one expected. (CVE-2018-5170)

Multiple security issues were discovered in Skia. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2018-5183)

It was discovered that S/MIME encrypted messages with remote content could leak plaintext via a chosen-ciphertext attack. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5184)

It was discovered that plaintext of decrypted emails could leak by submitting an embedded form. An attacker could potentially exploit this to obtain sensitive information. (CVE-2018-5185)