CVE-2018-5131

Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a copy from the network as it should. This can result in previously stored, locally cached data of a website being accessible to users if they share a common profile while browsing. This vulnerability affects Firefox ESR < 52.7 and Firefox < 59.

Memory safety bugs fixed in Firefox ESR 52.7 (CVE-2018-5125).

Buffer overflow manipulating SVG animatedPathSegList (CVE-2018-5127).

Out-of-bounds write with malformed IPC messages (CVE-2018-5129).

Mismatched RTP payload type can trigger memory corruption (CVE-2018-5130).

Fetch API improperly returns cached copies of no-store/no-cache resources (CVE-2018-5131).

Integer overflow during Unicode conversion (CVE-2018-5144).

Memory safety bugs fixed in Firefox ESR 52.7 (CVE-2018-5145).

A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash (CVE-2018-5148).

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.49.1 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117, CVE-2018-5125, CVE-2018-5127, CVE-2018-5129, CVE-2018-5130, CVE-2018-5131, CVE-2018-5144, CVE-2018-5145, CVE-2018-5148, CVE-2018-5150, CVE-2018-5154, CVE-2018-5155, CVE-2018-5157, CVE-2018-5158, CVE-2018-5159, CVE-2018-5168, CVE-2018-5178, CVE-2018-5183, CVE-2018-6126)

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Security issues fixed in Firefox ESR 52.7.3 (bsc#1085130):

• CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
• CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
• CVE-2018-5129: Out-of-bounds write with malformed IPC messages
• CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
• CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources
• CVE-2018-5144: Integer overflow during Unicode conversion
• CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7
• CVE-2018-5146: Out of bounds memory write in libvorbis (bsc#1085671)
• CVE-2018-5147: Out of bounds memory write in libtremor (bsc#1085671)
• CVE-2018-5148: Use-after-free in compositor (MFSA 2018-10) (bsc#1087059)

This update for MozillaFirefox fixes the following issues:

Security issues fixed in Firefox ESR 52.7.3 (bsc#1085130):

• CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
• CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
• CVE-2018-5129: Out-of-bounds write with malformed IPC messages
• CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
• CVE-2018-5131: Fetch API improperly returns cached copies of no-store/no-cache resources
• CVE-2018-5144: Integer overflow during Unicode conversion
• CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7
• CVE-2018-5146: Out of bounds memory write in libvorbis (bsc#1085671)
• CVE-2018-5147: Out of bounds memory write in libtremor (bsc#1085671)
• CVE-2018-5148: Use-after-free in compositor (MFSA 2018-10) (bsc#1087059)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash or opening new tabs, escape the sandbox, bypass same-origin restrictions, obtain sensitive information, confuse the user with misleading permission requests, or execute arbitrary code. (CVE-2018-5125, CVE-2018-5126, CVE-2018-5127, CVE-2018-5128, CVE-2018-5129, CVE-2018-5130, CVE-2018-5136, CVE-2018-5137, CVE-2018-5140, CVE-2018-5141, CVE-2018-5142)

It was discovered that the fetch() API could incorrectly return cached copies of no-store/no-cache resources in some circumstances. A local attacker could potentially exploit this to obtain sensitive information in environments where multiple users share a common profile. (CVE-2018-5131)

Multiple security issues were discovered with WebExtensions. If a user were tricked in to installing a specially crafted extension, an attacker could potentially exploit these to obtain sensitive information or bypass security restrictions. (CVE-2018-5132, CVE-2018-5134, CVE-2018-5135)

It was discovered that the value of app.support.baseURL is not sanitized properly. If a malicious local application were to set this to a specially crafted value, an attacker could potentially exploit this to execute arbitrary code. (CVE-2018-5133)

It was discovered that javascript: URLs with embedded tab characters could be pasted in to the addressbar. If a user were tricked in to copying a specially crafted URL in to the addressbar, an attacker could exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2018-5143)