CVE-2017-7824

A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with the permission of the user running the application (CVE-2017-7805).

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-7810, CVE-2017-7793, CVE-2017-7818, CVE-2017-7819, CVE-2017-7824, CVE-2017-7814, CVE-2017-7823).

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.48 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399, CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404, CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410, CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414, CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426, CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421, CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433, CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439, CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444, CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449, CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459, CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465, CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472, CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753, CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758, CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765, CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779, CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787, CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800, CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805, CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818, CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826, CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)

Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)

• new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.override_list_reply_to allows to restore the previous behavior.
• Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use.
• IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko 52.4esr
• CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API
• CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array manipulation
• CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in design mode
• CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and validating elements with ANGLE
• CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free in TLS 1.2 generating handshake hashes
• CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and malware protection warnings
• CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render some Tibetan and Arabic unicode characters as spaces
• CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a unique origin
• CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

• Add alsa-devel BuildRequires: we care for ALSA support to be built and thus need to ensure we get the dependencies in place. In the past, alsa-devel was pulled in by accident: we buildrequire libgnome-devel. This required esound-devel and that in turn pulled in alsa-devel for us. libgnome is being fixed to no longer require esound-devel.

Mozilla Thunderbird was updated to 52.4.0 (boo#1060445)

• new behavior was introduced for replies to mailing list posts: 'When replying to a mailing list, reply will be sent to address in From header ignoring Reply-to header'. A new preference mail.override_list_reply_to allows to restore the previous behavior.
• Under certain circumstances (image attachment and non-image attachment), attached images were shown truncated in messages stored in IMAP folders not synchronised for offline use.
• IMAP UIDs > 0x7FFFFFFF now handled properly Security fixes from Gecko 52.4esr
• CVE-2017-7793 (bmo#1371889) Use-after-free with Fetch API
• CVE-2017-7818 (bmo#1363723) Use-after-free during ARIA array manipulation
• CVE-2017-7819 (bmo#1380292) Use-after-free while resizing images in design mode
• CVE-2017-7824 (bmo#1398381) Buffer overflow when drawing and validating elements with ANGLE
• CVE-2017-7805 (bmo#1377618) (fixed via NSS requirement) Use-after-free in TLS 1.2 generating handshake hashes
• CVE-2017-7814 (bmo#1376036) Blob and data URLs bypass phishing and malware protection warnings
• CVE-2017-7825 (bmo#1393624, bmo#1390980) (OSX-only) OS X fonts render some Tibetan and Arabic unicode characters as spaces
• CVE-2017-7823 (bmo#1396320) CSP sandbox directive did not create a unique origin
• CVE-2017-7810 Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4

• Add alsa-devel BuildRequires: we care for ALSA support to be built and thus need to ensure we get the dependencies in place. In the past, alsa-devel was pulled in by accident: we buildrequire libgnome-devel. This required esound-devel and that in turn pulled in alsa-devel for us. libgnome is being fixed to no longer require esound-devel.

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to ESR 52.4, mozilla-nss fixes the following issues:

This security issue was fixed for mozilla-nss:

• CVE-2017-7805: Prevent use-after-free in TLS 1.2 when generating handshake hashes (bsc#1061005)

These security issues were fixed for Firefox

• CVE-2017-7825: Fixed some Tibetan and Arabic unicode characters rendering (bsc#1060445).
• CVE-2017-7805: Prevent Use-after-free in TLS 1.2 generating handshake hashes (bsc#1060445).
• CVE-2017-7819: Prevent Use-after-free while resizing images in design mode (bsc#1060445).
• CVE-2017-7818: Prevent Use-after-free during ARIA array manipulation (bsc#1060445).
• CVE-2017-7793: Prevent Use-after-free with Fetch API (bsc#1060445).
• CVE-2017-7824: Prevent Buffer overflow when drawing and validating elements with ANGLE (bsc#1060445).
• CVE-2017-7810: Fixed several memory safety bugs (bsc#1060445).
• CVE-2017-7823: CSP sandbox directive did not create a unique origin (bsc#1060445).
• CVE-2017-7814: Blob and data URLs bypassed phishing and malware protection warnings (bsc#1060445).

This update for MozillaFirefox and mozilla-nss fixes the following issues:

Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)

• MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
• MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode
• MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation
• MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API
• MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
• MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
• MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin
• MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

Mozilla Network Security Services (Mozilla NSS) received a security fix:

• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445)

This update for MozillaFirefox and mozilla-nss fixes the following issues:

Mozilla Firefox was updated to ESR 52.4 (bsc#1060445)

• MFSA 2017-22/CVE-2017-7825: OS X fonts render some Tibetan and Arabic unicode characters as spaces
• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes
• MFSA 2017-22/CVE-2017-7819: Use-after-free while resizing images in design mode
• MFSA 2017-22/CVE-2017-7818: Use-after-free during ARIA array manipulation
• MFSA 2017-22/CVE-2017-7793: Use-after-free with Fetch API
• MFSA 2017-22/CVE-2017-7824: Buffer overflow when drawing and validating elements with ANGLE
• MFSA 2017-22/CVE-2017-7810: Memory safety bugs fixed in Firefox 56 and Firefox ESR 52.4
• MFSA 2017-22/CVE-2017-7823: CSP sandbox directive did not create a unique origin
• MFSA 2017-22/CVE-2017-7814: Blob and data URLs bypass phishing and malware protection warnings

Mozilla Network Security Services (Mozilla NSS) received a security fix:

• MFSA 2017-22/CVE-2017-7805: Use-after-free in TLS 1.2 generating handshake hashes (bsc#1061005, bsc#1060445)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to read uninitialized memory, obtain sensitive information, bypass phishing and malware protection, spoof the origin in modal dialogs, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7811, CVE-2017-7812, CVE-2017-7813, CVE-2017-7814, CVE-2017-7815, CVE-2017-7818, CVE-2017-7819, CVE-2017-7820, CVE-2017-7822, CVE-2017-7823, CVE-2017-7824)

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)

Multiple security issues were discovered in WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to download and open non-executable files without interaction, or obtain elevated privileges. (CVE-2017-7816, CVE-2017-7821)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing-like context, an attacker could potentially exploit these to read uninitialized memory, bypass phishing and malware protection, conduct cross-site scripting (XSS) attacks, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7793, CVE-2017-7810, CVE-2017-7814, CVE-2017-7818, CVE-2017-7819, CVE-2017-7823, CVE-2017-7824)

Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-7805)