CVE-2019-9813

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write. This vulnerability affects Firefox < 66.0.1, Firefox ESR < 60.6.1, and Thunderbird < 60.6.1.

Use-after-free when removing in-use DOM elements. (CVE-2019-9790)

Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey. (CVE-2019-9791)

IonMonkey leaks JS_OPTIMIZED_OUT magic value to script. (CVE-2019-9792)

Improper bounds checks when Spectre mitigations are disabled. (CVE-2019-9793)

Command line arguments not discarded during execution. (CVE-2019-9794)

Type-confusion in IonMonkey JIT compiler. (CVE-2019-9795)

Use-after-free with SMIL animation controller. (CVE-2019-9796)

Windows programs that are not 'URL Handlers' are exposed to web content. (CVE-2019-9801)

Proxy Auto-Configuration file can define localhost access to be proxied. (CVE-2018-18506)

Memory safety bugs fixed in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. (CVE-2019-9788)

IonMonkey MArraySlice has incorrect alias information. (CVE-2019-9810)

Ionmonkey type confusion with proto mutations. (CVE-2019-9813)

Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow (CVE-2019-9810).

Incorrect handling of proto mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arbitrary memory read and write (CVE-2019-9813).

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 60.6.1esr / MFSA 2019-10 (bsc#1130262)

• CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information
• CVE-2019-9813: Ionmonkey type confusion with proto mutations

Mozilla Firefox was updated to 60.6.0esr / MFSA 2019-08 (boo#1129821)

• CVE-2019-9790: Use-after-free when removing in-use DOM elements
• CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
• CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
• CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled
• CVE-2019-9794: Command line arguments not discarded during execution
• CVE-2019-9795: Type-confusion in IonMonkey JIT compiler
• CVE-2019-9796: Use-after-free with SMIL animation controller
• CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied
• CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6

Mozilla Firefox 60.5.2esr also had one change:

• Fix a frequent crash when reading various Reuters news articles.

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to MozillaThunderbird 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Security issuess addressed:

• update to Firefox ESR 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to Firefox ESR 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to Firefox ESR 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

• Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to MozillaThunderbird 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

This update for MozillaFirefox to version ESR 60.6.1 fixes the following issues:

Security issuess addressed:

• update to Firefox ESR 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to Firefox ESR 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to Firefox ESR 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

• Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

Two security issues were discovered in the JavaScript engine in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code.

It was discovered that Thunderbird allowed PAC files to specify that requests to localhost are sent through the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit this to conduct attacks on local services and tools. (CVE-2018-18506)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2019-9788, CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9810, CVE-2019-9813)

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. If a user were tricked in to opening a specially crafted website in a browsing context with Spectre mitigations disabled, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-9793)