CVE-2019-11735

Mozilla developers and community members reported memory safety bugs present in Firefox 68 and Firefox ESR 68. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 69 and Firefox ESR < 68.1.

The updated packages fix several bugs and some security issues:

Sandbox escape through Firefox Sync. (CVE-2019-9812)

Stored passwords in 'Saved Logins' can be copied without master password entry. (CVE-2019-11733)

Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1. (CVE-2019-11735)

File manipulation and privilege escalation in Mozilla Maintenance Service. (CVE-2019-11736)

Content security policy bypass through hash-based sources in directives. (CVE-2019-11738)

Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9. (CVE-2019-11740)

Same-origin policy violation with SVG filters and canvas to steal cross-origin images. (CVE-2019-11742)

Cross-origin access to unload event attributes. (CVE-2019-11743)

XSS by breaking out of title and textarea elements using innerHTML. (CVE-2019-11744)

Use-after-free while manipulating video. (CVE-2019-11746)

'Forget about this site' removes sites from pre-loaded HSTS list. (CVE-2019-11747)

Persistence of WebRTC permissions in a third party context. (CVE-2019-11748)

Camera information available without prompting using getUserMedia. (CVE-2019-11749)

Type confusion in Spidermonkey. (CVE-2019-11750)

Malicious code execution through command line parameters. (CVE-2019-11751)

Use-after-free while extracting a key value in IndexedDB. (CVE-2019-11752)

Privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (CVE-2019-11753)

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
• CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
• CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
• CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
• CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
• CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
• CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
• CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
• CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
• CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
• CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
• CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
• CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
• CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
• CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
• CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
• CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
• CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
• CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
• CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
• CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
• CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
• CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
• CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

• Latest update now also released for s390x. (bsc#1109465)
• Fixed a segmentation fault on s390vsl082. (bsc#1117473)
• Fixed a crash on SLES15 s390x. (bsc#1124525)
• Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
• CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
• CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
• CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
• CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
• CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
• CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
• CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
• CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
• CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
• CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
• CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
• CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
• CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
• CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
• CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
• CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
• CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
• CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
• CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
• CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
• CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
• CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
• CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

• Latest update now also released for s390x. (bsc#1109465)
• Fixed a segmentation fault on s390vsl082. (bsc#1117473)
• Fixed a crash on SLES15 s390x. (bsc#1124525)
• Fixed a segmentation fault. (bsc#1133810)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update contains the Mozilla Firefox ESR 68.2 release.

Mozilla Firefox was updated to ESR 68.2 release:

• Enterprise: New administrative policies were added. More information and templates are available at the Policy Templates page.

• Various security fixes: MFSA 2019-33 (bsc#1154738)

  • CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
  • CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
  • CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
  • CVE-2019-11759: Stack buffer overflow in HKDF output
  • CVE-2019-11760: Stack buffer overflow in WebRTC networking
  • CVE-2019-11761: Unintended access to a privileged JSONView object
  • CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
  • CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
  • CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2

Other Issues resolved:

• [bsc#1104841] Newer versions of firefox have a dependency on GLIBCXX_3.4.20
• [bsc#1074235] MozillaFirefox: background tab crash reports sent inadvertently without user opt-in
• [bsc#1043008] Firefox hangs randomly when browsing and scrolling
• [bsc#1025108] Firefox stops loading page until mouse is moved
• [bsc#905528] Firefox malfunctions due to broken omni.ja archives

This update for MozillaFirefox to 68.1 fixes the following issues:

Security issues fixed:

• CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
• CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
• CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
• CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
• CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
• CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
• CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
• CVE-2019-11721: Fixed a homograph domain spoofing issue through unicode latin 'kra' character. (bsc#1140868)
• CVE-2019-11723: Fixed a cookie leakage during add-on fetching across private browsing boundaries. (bsc#1140868)
• CVE-2019-11724: Fixed an outdated permission, granting access to retired site input.mozilla.org. (bsc#1140868)
• CVE-2019-11725: Fixed a Safebrowsing bypass involving WebSockets. (bsc#1140868)
• CVE-2019-11727: Fixed a vulnerability where it possible to force NSS to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. (bsc#1141322)
• CVE-2019-11728: Fixed an improper handling of the Alt-Svc header that allowed remote port scans. (bsc#1140868)
• CVE-2019-11733: Fixed an insufficient protection of stored passwords in 'Saved Logins'. (bnc#1145665)
• CVE-2019-11735: Fixed several memory safety bugs. (bnc#1149293)
• CVE-2019-11736: Fixed a file manipulation and privilege escalation in Mozilla Maintenance Service. (bnc#1149292)
• CVE-2019-11738: Fixed a content security policy bypass through hash-based sources in directives. (bnc#1149302)
• CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)
• CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)
• CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)
• CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)
• CVE-2019-11746: Fixed a use-after-free while manipulating video. (bsc#1149297)
• CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)
• CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

Non-security issues fixed:

• Latest update now also released for s390x. (bsc#1109465)
• Fixed a segmentation fault on s390vsl082. (bsc#1117473)
• Fixed a crash on SLES15 s390x. (bsc#1124525)
• Fixed a segmentation fault. (bsc#1133810)

This update for MozillaFirefox fixes the following issues:

Updated to new ESR version 68.1 (bsc#1149323).

In addition to the already fixed vulnerabilities released in previous ESR updates, the following were also fixed: CVE-2019-11751, CVE-2019-11736, CVE-2019-9812, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11738, CVE-2019-11747, CVE-2019-11735.

Several run-time issues were also resolved (bsc#1117473, bsc#1124525, bsc#1133810).

The version displayed in Help > About is now correct (bsc#1087200).

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, bypass Content Security Policy (CSP) protections, bypass same-origin restrictions, conduct cross-site scripting (XSS) attacks, cause a denial of service, or execute arbitrary code. (CVE-2019-5849, CVE-2019-11734, CVE-2019-11735, CVE-2019-11737, CVE-2019-11738, CVE-2019-11740, CVE-2019-11742, CVE-2019-11743, CVE-2019-11744, CVE-2019-11746, CVE-2019-11748, CVE-2019-11749, CVE-2019-11750, CVE-2019-11752)

It was discovered that a compromised content process could log in to a malicious Firefox Sync account. An attacker could potentially exploit this, in combination with another vulnerability, to disable the sandbox. (CVE-2019-9812)

It was discovered that addons.mozilla.org and accounts.firefox.com could be loaded in to the same content process. An attacker could potentially exploit this, in combination with another vulnerability that allowed a cross-site scripting (XSS) attack, to modify browser settings. (CVE-2019-11741)

It was discovered that the "Forget about this site" feature in the history pane removes HTTP Strict Transport Security (HSTS) settings for sites on the pre-load list. An attacker could potentially exploit this to bypass the protections offered by HSTS. (CVE-2019-11747)