CVE-2016-1955

Mozilla Firefox before 45.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by reading a Content Security Policy (CSP) violation report that contains path information associated with an IFRAME element.

This update contains Mozilla Thunderbird 45.2. (boo#983549)

It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail.

The following vulnerabilities were fixed:

• CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49)

Contains the following security fixes from the 45.1 release: (boo#977333)

• CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39)

Contains the following security fixes from the 45.0 release: (boo#969894)

• CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16)
• CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)
• CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18)
• CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19)
• CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)
• CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23)
• CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24)
• CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27)
• CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The graphite font shaping library was disabled, addressing the following font vulnerabilities:

• MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

The following tracked packaging changes are included:

• fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637)
• gcc6 fixes (boo#986162)
• running on 48bit va aarch64 (boo#984126)

This update contains Mozilla Thunderbird 45.2. (boo#983549)

It fixes security issues mostly affecting the e-mail program when used in a browser context, such as viewing a web page or HTMl formatted e-mail.

The following vulnerabilities were fixed:

• CVE-2016-2818, CVE-2016-2815: Memory safety bugs (boo#983549, MFSA2016-49)

Contains the following security fixes from the 45.1 release: (boo#977333)

• CVE-2016-2806, CVE-2016-2807: Miscellaneous memory safety hazards (boo#977375, boo#977376, MFSA 2016-39)

Contains the following security fixes from the 45.0 release: (boo#969894)

• CVE-2016-1952, CVE-2016-1953: Miscellaneous memory safety hazards (MFSA 2016-16)
• CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports (MFSA 2016-17)
• CVE-2016-1955: CSP reports fail to strip location information for embedded iframe pages (MFSA 2016-18)
• CVE-2016-1956: Linux video memory DOS with Intel drivers (MFSA 2016-19)
• CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing (MFSA 2016-20)
• CVE-2016-1960: Use-after-free in HTML5 string parser (MFSA 2016-23)
• CVE-2016-1961: Use-after-free in SetBody (MFSA 2016-24)
• CVE-2016-1964: Use-after-free during XML transformations (MFSA 2016-27)
• CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation (MFSA 2016-34)

The graphite font shaping library was disabled, addressing the following font vulnerabilities:

• MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802

The following tracked packaging changes are included:

• fix build issues with gcc/binutils combination used in Leap 42.2 (boo#984637)
• gcc6 fixes (boo#986162)
• running on 48bit va aarch64 (boo#984126)

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Francis Gabriel discovered a buffer overflow during ASN.1 decoding in NSS. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1950)

Bob Clary, Christoph Diehl, Christian Holler, Andrew McCreight, Daniel Holbert, Jesse Ruderman, Randell Jesup, Carsten Book, Gian-Carlo Pascutto, Tyson Smith, Andrea Marchesini, and Jukka Jylänki discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1952, CVE-2016-1953)

Nicolas Golubovic discovered that CSP violation reports can be used to overwrite local files. If a user were tricked in to opening a specially crafted website with addon signing disabled and unpacked addons installed, an attacker could potentially exploit this to gain additional privileges. (CVE-2016-1954)

Muneaki Nishimura discovered that CSP violation reports contained full paths for cross-origin iframe navigations. An attacker could potentially exploit this to steal confidential data. (CVE-2016-1955)

Ucha Gobejishvili discovered that performing certain WebGL operations resulted in memory resource exhaustion with some Intel GPUs, requiring a reboot. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-1956)

Jose Martinez and Romina Santillan discovered a memory leak in libstagefright during MPEG4 video file processing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via memory exhaustion. (CVE-2016-1957)

Abdulrahman Alqabandi discovered that the addressbar could be blank or filled with page defined content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct URL spoofing attacks. (CVE-2016-1958)

Looben Yang discovered an out-of-bounds read in Service Worker Manager. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1959)

A use-after-free was discovered in the HTML5 string parser. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1960)

A use-after-free was discovered in the SetBody function of HTMLDocument. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1961)

Dominique Hazaël-Massieux discovered a use-after-free when using multiple WebRTC data channels. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1962)

It was discovered that Firefox crashes when local files are modified whilst being read by the FileReader API. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-1963)

Nicolas Grégoire discovered a use-after-free during XML transformations. If a user were tricked in to…