CVE-2019-9816

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.. This vulnerability affects Thunderbird < 60.7, Firefox < 67, and Firefox ESR < 60.7.

Updated thunderbird packages fixes bugs and security vulnerabilities:

Cross-origin theft of images with ImageBitmapRenderingContext. (CVE-2018-18511)

Out-of-bounds read in Skia. (CVE-2019-5798)

Use-after-free in png_image_free of libpng library. (CVE-2019-7317)

Cross-origin theft of images with createImageBitmap. (CVE-2019-9797)

Memory safety bugs fixed in Thunderbird 60.7. (CVE-2019-9800)

Type confusion with object groups and UnboxedObjects. (CVE-2019-9816)

Stealing of cross-domain images using canvas. (CVE-2019-9817)

Use-after-free in crash generation server. (CVE-2019-9818)

Compartment mismatch with fetch API. (CVE-2019-9819)

Use-after-free of ChromeEventHandler by DocShell. (CVE-2019-9820)

Use-after-free in XMLHttpRequest. (CVE-2019-11691)

Use-after-free removing listeners in the event listener manager. (CVE-2019-11692)

Buffer overflow in WebGL bufferdata on Linux. (CVE-2019-11693)

Theft of user history data through drag and drop of hyperlinks to and from bookmarks. (CVE-2019-11698)

Inline-PGP messages that allows an attacker to have Enigmail display a correctly signed or encrypted message info, but display a different unauthenticated text.

Updated firefox packages fix security vulnerabilities.

Cross-origin theft of images with ImageBitmapRenderingContext. (CVE-2018-18511)

Out-of-bounds read in Skia. (CVE-2019-5798)

Use-after-free in png_image_free of libpng library. (CVE-2019-7317)

Cross-origin theft of images with createImageBitmap. (CVE-2019-9797)

Memory safety bugs fixed in Firefox 67, Firefox ESR 60.7, and firefox 60.7. (CVE-2019-9800)

Type confusion with object groups and UnboxedObjects. (CVE-2019-9816)

Stealing of cross-domain images using canvas. (CVE-2019-9817)

Use-after-free in crash generation server. (CVE-2019-9818)

Compartment mismatch with fetch API. (CVE-2019-9819)

Use-after-free of ChromeEventHandler by DocShell. (CVE-2019-9820)

Use-after-free in XMLHttpRequest. (CVE-2019-11691)

Use-after-free removing listeners in the event listener manager. (CVE-2019-11692)

Buffer overflow in WebGL bufferdata on Linux. (CVE-2019-11693)

Theft of user history data through drag and drop of hyperlinks to and from bookmarks. (CVE-2019-11698)

This update for MozillaFirefox fixes the following issues:

MozillaFirefox was updated to 60.7.0esr (boo#1135824 MFSA 2019-14):

• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
• CVE-2019-11691: Use-after-free in XMLHttpRequest
• CVE-2019-11692: Use-after-free removing listeners in the event listener manager
• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
• CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox
• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
• CVE-2019-5798: Out-of-bounds read in Skia
• CVE-2019-7317: Use-after-free in png_image_free of libpng library
• CVE-2019-9797: Cross-origin theft of images with createImageBitmap
• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
• CVE-2019-9816: Type confusion with object groups and UnboxedObjects
• CVE-2019-9817: Stealing of cross-domain images using canvas
• CVE-2019-9818: (Windows only) Use-after-free in crash generation server
• CVE-2019-9819: Compartment mismatch with fetch API
• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
• CVE-2019-9821: Use-after-free in AssertWorkerThread

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872):

• CVE-2019-11707: Type confusion in Array.pop
• CVE-2019-11708: sandbox escape using Prompt:Open

Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595):

• CVE-2019-11703: Heap buffer overflow in icalparser.c
• CVE-2019-11704: Heap buffer overflow in icalvalue.c
• CVE-2019-11705: Stack buffer overflow in icalrecur.c
• CVE-2019-11706: Type confusion in icalproperty.c

Also fixed: No prompt for smartcard PIN when S/MIME signing is used

Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824):

• Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

• CVE-2019-9816: Type confusion with object groups and UnboxedObjects

• CVE-2019-9817: Stealing of cross-domain images using canvas

• CVE-2019-9818 (Windows only): Use-after-free in crash generation server

• CVE-2019-9819: Compartment mismatch with fetch API

• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

• CVE-2019-11691: Use-after-free in XMLHttpRequest

• CVE-2019-11692: Use-after-free removing listeners in the event listener manager

• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

• CVE-2019-7317: Use-after-free in png_image_free of libpng library

• CVE-2019-9797: Cross-origin theft of images with createImageBitmap

• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext

• CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

• CVE-2019-5798: Out-of-bounds read in Skia

• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

• Disable building with LTO (boo#1133267).

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

• CVE-2019-11691: Use-after-free in XMLHttpRequest
• CVE-2019-11692: Use-after-free removing listeners in the event listener manager
• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
• CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox
• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
• CVE-2019-7317: Use-after-free in png_image_free of libpng library
• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
• CVE-2019-9816: Type confusion with object groups and UnboxedObjects
• CVE-2019-9817: Stealing of cross-domain images using canvas
• CVE-2019-9818: Use-after-free in crash generation server
• CVE-2019-9819: Compartment mismatch with fetch API
• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

Non-security issues fixed:

• Font and date adjustments to accommodate the new Reiwa era in Japan
• Update to Firefox ESR 60.7 (bsc#1135824)

This update for MozillaFirefox fixes the following issues:

Security issues fixed:

• CVE-2019-11691: Use-after-free in XMLHttpRequest
• CVE-2019-11692: Use-after-free removing listeners in the event listener manager
• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
• CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox
• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
• CVE-2019-7317: Use-after-free in png_image_free of libpng library
• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
• CVE-2019-9816: Type confusion with object groups and UnboxedObjects
• CVE-2019-9817: Stealing of cross-domain images using canvas
• CVE-2019-9818: Use-after-free in crash generation server
• CVE-2019-9819: Compartment mismatch with fetch API
• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

Non-security issues fixed:

• Font and date adjustments to accommodate the new Reiwa era in Japan
• Update to Firefox ESR 60.7 (bsc#1135824)

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.0.

• Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

These security issues were fixed (MFSA 2019-15 bsc#1135824):

• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS
• CVE-2019-9816: Type confusion with object groups and UnboxedObjects
• CVE-2019-9817: Stealing of cross-domain images using canvas
• CVE-2019-9818: Use-after-free in crash generation server
• CVE-2019-9819: Compartment mismatch with fetch API
• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell
• CVE-2019-11691: Use-after-free in XMLHttpRequest
• CVE-2019-11692: Use-after-free removing listeners in the event listener manager
• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
• CVE-2019-7317: Use-after-free in png_image_free of libpng library
• CVE-2019-9797: Cross-origin theft of images with createImageBitmap
• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext
• CVE-2019-11694: (Windows only) Uninitialized memory memory leakage in Windows sandbox
• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
• CVE-2019-5798: Out-of-bounds read in Skia
• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the browser UI, trick the user in to launching local executable binaries, obtain sensitive information, conduct cross-site scripting (XSS) attacks, or execute arbitrary code. (CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-11695, CVE-2019-11696, CVE-2019-11699, CVE-2019-11701, CVE-2019-7317, CVE-2019-9800, CVE-2019-9814, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820, CVE-2019-9821)

It was discovered that pressing certain key combinations could bypass addon installation prompt delays. If a user opened a specially crafted website, an attacker could potentially exploit this to trick them in to installing a malicious extension. (CVE-2019-11697)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to the bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, bypass same-origin protections, or execute arbitrary code. (CVE-2019-18511, CVE-2019-11691, CVE-2019-11692, CVE-2019-11693, CVE-2019-9797, CVE-2019-9800, CVE-2019-9817, CVE-2019-9819, CVE-2019-9820)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2019-5798, CVE-2019-7317)

A type confusion bug was discovered with object groups and UnboxedObjects. If a user were tricked in to opening a specially crafted website in a browsing context after enabling the UnboxedObjects feature, an attacker could potentially exploit this to bypass security checks. (CVE-2019-9816)

It was discovered that history data could be exposed via drag and drop of hyperlinks to and from bookmarks. If a user were tricked in to dragging a specially crafted hyperlink to a bookmark toolbar or sidebar, and subsequently back in to the web content area, an attacker could potentially exploit this to obtain sensitive information. (CVE-2019-11698)