CVE-2018-12368

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. Note: this issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. Note: this issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. Note: this issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. Note: this issue only affects Windows operating systems. Other operating systems are unaffected.. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.

• Buffer overflow using computed size of canvas element. (CVE-2018-12359)

• Use-after-free when using focus(). (CVE-2018-12360)

• Integer overflow in SwizzleData. (CVE-2018-12361)

• Integer overflow in SSSE3 scaler. (CVE-2018-12362)

• Media recorder segmentation fault when track type is changed during capture. (CVE-2018-5156)

• Use-after-free when appending DOM nodes. (CVE-2018-12363)

• CSRF attacks through 307 redirects and NPAPI plugins. (CVE-2018-12364)

• Compromised IPC child process can list local filenames. (CVE-2018-12365)

• Integer overflow in Skia library during edge builder allocation. (CVE-2018-12371)

• Invalid data handling during QCMS transformations. (CVE-2018-12366)

• Timing attack mitigation of PerformanceNavigationTiming. (CVE-2018-12367)

• No warning when opening executable SettingContent-ms files. (CVE-2018-12368)

• Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60. (CVE-2018-5187)

• Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60. (CVE-2018-5188)

• Use-after-free in refresh driver timers. (CVE-2018-12377)

• Use-after-free in IndexedDB. (CVE-2018-12378)

• Out-of-bounds write with malicious MAR file. (CVE-2018-12379)

• Proxy bypass using automount and autofs. (CVE-2017-16541)

• Crash in TransportSecurityInfo due to cached data. (CVE-2018-12385)

• Setting a master password post-Firefox 58 does not delete unencrypted previously stored passwords. (CVE-2018-12383)

• Memory safety bugs fixed in Firefox 62, Firefox ESR 60.2, and Thunderbird 60.2.1. (CVE-2018-12376)

• HTTP Live Stream audio data is accessible cross-origin. (CVE-2018-12391)

• Crash with nested event loops. (CVE-2018-12392)

• Integer overflow during Unicode conversion while loading JavaScript. (CVE-2018-12393)

• Memory safety bugs fixed in Firefox ESR 60.3 and Thunderbird 60.3. (CVE-2018-12389)

• Memory safety bugs fixed in Firefox 63, Firefox ESR 60.3, and Thunderbird 60.3. (CVE-2018-12390)

This update for MozillaFirefox to the 52.9 ESR release fixes the following issues:

These security issues were fixed:

• Firefox ESR 52.9:

• CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998).

• CVE-2018-12368 No warning when opening executable SettingContent-ms files (bsc#1098998).

• CVE-2018-12366 Invalid data handling during QCMS transformations (bsc#1098998).

• CVE-2018-12365 Compromised IPC child process can list local filenames (bsc#1098998).

• CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).

• CVE-2018-12363 Use-after-free when appending DOM nodes (bsc#1098998).

• CVE-2018-12362 Integer overflow in SSSE3 scaler (bsc#1098998).

• CVE-2018-12360 Use-after-free when using focus() (bsc#1098998).

• CVE-2018-5156 Media recorder segmentation fault when track type is changed during capture (bsc#1098998).

• CVE-2018-12359 Buffer overflow using computed size of canvas element (bsc#1098998).

• Firefox ESR 52.8:

• CVE-2018-6126: Prevent heap buffer overflow in rasterizing paths in SVG with Skia (bsc#1096449).

• CVE-2018-5183: Backport critical security fixes in Skia (bsc#1092548).

• CVE-2018-5154: Use-after-free with SVG animations and clip paths (bsc#1092548).

• CVE-2018-5155: Use-after-free with SVG animations and text paths (bsc#1092548).

• CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files (bsc#1092548).

• CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer (bsc#1092548).

• CVE-2018-5159: Integer overflow and out-of-bounds write in Skia (bsc#1092548).

• CVE-2018-5168: Lightweight themes can be installed without user interaction (bsc#1092548).

• CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension (bsc#1092548).

• CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8 (bsc#1092548).

These non-security issues were fixed:

• Various stability and regression fixes
• Performance improvements to the Safe Browsing service to avoid slowdowns while updating site classification data

This update for MozillaFirefox to version ESR 52.9 fixes the following issues:

• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12368: No warning when opening executable SettingContent-ms files
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12359: Buffer overflow using computed size of canvas element

This update for MozillaFirefox to version ESR 52.9 fixes the following issues:

• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12368: No warning when opening executable SettingContent-ms files
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12359: Buffer overflow using computed size of canvas element

This update for MozillaFirefox to version ESR 52.9 fixes the following issues:

• CVE-2018-5188: Various memory safety bugs (bsc#1098998)
• CVE-2018-12368: No warning when opening executable SettingContent-ms files
• CVE-2018-12366: Invalid data handling during QCMS transformations
• CVE-2018-12365: Compromised IPC child process can list local filenames
• CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
• CVE-2018-12363: Use-after-free when appending DOM nodes
• CVE-2018-12362: Integer overflow in SSSE3 scaler
• CVE-2018-12360: Use-after-free when using focus()
• CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
• CVE-2018-12359: Buffer overflow using computed size of canvas element