CVE-2018-18356

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a potentially exploitable crash. (CVE-2018-18356)

An integer overflow vulnerability in the Skia library can occur after specific transform operations, leading to a potentially exploitable crash. (CVE-2019-5785)

A buffer overflow vulnerability in the Skia library can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. (CVE-2018-18335)

A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with arbitrary content. (CVE-2018-18509)

A use-after-free vulnerability in the Skia library can occur when creating a path, leading to a potentially exploitable crash (CVE-2018-18356).

An integer overflow vulnerability in the Skia library can occur after specific transform operations, leading to a potentially exploitable crash (CVE-2019-5785).

This update to Chromium 71.0.3578.98 fixes the following issues:

Security issues fixed (boo#1118529):

• CVE-2018-17480: Out of bounds write in V8
• CVE-2018-17481: Use after frees in PDFium
• CVE-2018-18335: Heap buffer overflow in Skia
• CVE-2018-18336: Use after free in PDFium
• CVE-2018-18337: Use after free in Blink
• CVE-2018-18338: Heap buffer overflow in Canvas
• CVE-2018-18339: Use after free in WebAudio
• CVE-2018-18340: Use after free in MediaRecorder
• CVE-2018-18341: Heap buffer overflow in Blink
• CVE-2018-18342: Out of bounds write in V8
• CVE-2018-18343: Use after free in Skia
• CVE-2018-18344: Inappropriate implementation in Extensions
• Multiple issues in SQLite via WebSQL
• CVE-2018-18345: Inappropriate implementation in Site Isolation
• CVE-2018-18346: Incorrect security UI in Blink
• CVE-2018-18347: Inappropriate implementation in Navigation
• CVE-2018-18348: Inappropriate implementation in Omnibox
• CVE-2018-18349: Insufficient policy enforcement in Blink
• CVE-2018-18350: Insufficient policy enforcement in Blink
• CVE-2018-18351: Insufficient policy enforcement in Navigation
• CVE-2018-18352: Inappropriate implementation in Media
• CVE-2018-18353: Inappropriate implementation in Network Authentication
• CVE-2018-18354: Insufficient data validation in Shell Integration
• CVE-2018-18355: Insufficient policy enforcement in URL Formatter
• CVE-2018-18356: Use after free in Skia
• CVE-2018-18357: Insufficient policy enforcement in URL Formatter
• CVE-2018-18358: Insufficient policy enforcement in Proxy
• CVE-2018-18359: Out of bounds read in V8
• Inappropriate implementation in PDFium
• Use after free in Extensions
• Inappropriate implementation in Navigation
• Insufficient policy enforcement in Navigation
• Insufficient policy enforcement in URL Formatter
• Various fixes from internal audits, fuzzing and other initiatives
• CVE-2018-17481: Use after free in PDFium (boo#1119364)

The following changes are included:

• advertisements posing as error messages are now blocked
• Automatic playing of content at page load mostly disabled
• New JavaScript API for relative time display

This update for MozillaFirefox to version 60.5.1esr fixes the following issues:

Security vulnerabilities addressed (MFSA-2019-05, boo#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library that could occur when creating a path, leading to a potentially exploitable crash.
• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library that could occur after specific transform operations, leading to a potentially exploitable crash.

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security vulnerabilities addressed (MFSA 2019-03 MFSA 2018-31 bsc#1122983 and MFSA 2019-06 bsc#1125330):

• CVE-2018-18356: Fixed a Use-after-free in Skia.
• CVE-2019-5785: Fixed an Integer overflow in Skia.
• CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions.
• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature.
• CVE-2018-18500: Use-after-free parsing HTML5 stream
• CVE-2018-18505: Privilege escalation through IPC channel messages
• CVE-2016-5824: DoS (use-after-free) via a crafted ics file
• CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5
• CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
• CVE-2018-18492: Use-after-free with select element
• CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
• CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
• CVE-2018-18498: Integer overflow when calculating buffer sizes for images
• CVE-2018-12405: Memory safety bugs

Other bug fixes and changes:

• FileLink provider WeTransfer to upload large attachments
• Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user inferface: [+] button to select a file an add, [-] to remove.
• More search engines: Google and DuckDuckGo available by default in some locales
• During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol.
• Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on
• New WebExtensions FileLink API to facilitate add-ons
• Fix decoding problems for messages with less common charsets (cp932, cp936)
• New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification
• Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db). Thunderbird 60.3.2 and earlier contained a fault that potentially deleted saved passwords and private certificate keys for users using a master password. Version 60.3.3 will prevent the loss of data; affected users who have already upgraded to version 60.3.2 or earlier can restore the deleted key3.db file from backup to complete the migration.
• Address book search and auto-complete slowness introduced in Thunderbird 60.3.2
• Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters
• While composing a message, a link not removed when link location was removed in the link properties panel
• Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding
• If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from 'Received' header instead.
• Body search/filtering didn't reliably ignore content of tags
• Inappropriate warning 'Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer' when installing add-ons
• Incorrect display of correspondents column since own email address was not always detected
• Spurious (encoded newline) inserted into drafts and sent email
• Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog
• Fixe Cookie removal
• 'Download rest of message' was not working if global inbox was used
• Fix Encoding problems for users (especially in Poland) when a file was sent via a folder…

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security vulnerabilities addressed (MSFA 2019-03 MSFA 2018-31 MFSA 2019-06 bsc#1122983 bsc#1119105 bsc#1125330):

• CVE-2018-18356: Fixed a Use-after-free in Skia.
• CVE-2019-5785: Fixed an Integer overflow in Skia.
• CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions.
• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistekenly that emails bring a valid sugnature.
• CVE-2018-18500: Use-after-free parsing HTML5 stream
• CVE-2018-18505: Privilege escalation through IPC channel messages
• CVE-2016-5824 DoS (use-after-free) via a crafted ics file
• CVE-2018-18501: Memory safety bugs fixed in Firefox 65 and Firefox ESR 60.5
• CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
• CVE-2018-18492: Use-after-free with select element
• CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
• CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
• CVE-2018-18498: Integer overflow when calculating buffer sizes for images
• CVE-2018-12405: Memory safety bugs fixed in Firefox 64, 60.4, and Thunderbird 60.4

Other bug fixes and changes:

• FileLink provider WeTransfer to upload large attachments
• Thunderbird now allows the addition of OpenSearch search engines from a local XML file using a minimal user interface: [+] button to select a file an add, [-] to remove.
• More search engines: Google and DuckDuckGo available by default in some locales
• During account creation, Thunderbird will now detect servers using the Microsoft Exchange protocol. It will offer the installation of a 3rd party add-on (Owl) which supports that protocol.
• Thunderbird now compatible with other WebExtension-based FileLink add-ons like the Dropbox add-on
• New WebExtensions FileLink API to facilitate add-ons
• Fix decoding problems for messages with less common charsets (cp932, cp936)
• New messages in the drafts folder (and other special or virtual folders) will no longer be included in the new messages notification
• Thunderbird 60 will migrate security databases (key3.db, cert8.db to key4.db, cert9.db).
• Address book search and auto-complete slowness
• Plain text markup with * for bold, / for italics, _ for underline and | for code did not work when the enclosed text contained non-ASCII characters
• While composing a message, a link not removed when link location was removed in the link properties panel
• Encoding problems when exporting address books or messages using the system charset. Messages are now always exported using the UTF-8 encoding
• If the 'Date' header of a message was invalid, Jan 1970 or Dec 1969 was displayed. Now using date from 'Received' header instead.
• Body search/filtering didn't reliably ignore content of tags
• Inappropriate warning 'Thunderbird prevented the site (addons.thunderbird.net) from asking you to install software on your computer' when installing add-ons
• Incorrect display of correspondents column since own email address was not always detected
• Spurious (encoded newline) inserted into drafts and sent email
• Double-clicking on a word in the Write window sometimes launched the Advanced Property Editor or Link Properties dialog
• Fixed Cookie removal
• 'Download rest of message' was not working if global inbox was used
• Fix Encoding problems for users (especially in Poland) when a file was sent via a folder using 'Sent to > Mail recipient' due to a problem in the Thunderbird MAPI interface
• According to RFC 4616 and RFC 5721, passwords containing non-ASCII characters are encoded using UTF-8 which can lead to problems with non-compliant providers, for example office365.com. The SMTP LOGIN and POP3 USER/PASS authentication methods are now…

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to MozillaThunderbird 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed (MFSA 2019-06 bsc#1125330):

• CVE-2018-18335: Fixed a Buffer overflow in Skia by default deactivating Canvas 2D. This issue does not affect Linuc distributions.
• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature.
• CVE-2018-18356: Fixed a Use-after-free in Skia.
• CVE-2019-5785: Fixed an Integer overflow in Skia.

This update for MozillaFirefox fixes the following issues:

Security issuess addressed:

• update to Firefox ESR 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to Firefox ESR 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to Firefox ESR 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

• Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to MozillaThunderbird 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

This update for MozillaFirefox to version ESR 60.6.1 fixes the following issues:

Security issuess addressed:

• update to Firefox ESR 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to Firefox ESR 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to Firefox ESR 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

• Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass same origin protections, or execute arbitrary code.

A use-after-free was discovered in libical. If a user were tricked in to opening a specially crafted ICS calendar file, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-5824)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18501, CVE-2018-18505)

An issue was discovered with S/MIME signature verification in some circumstances. An attacker could potentially exploit this by spoofing signatures for arbitrary content. (CVE-2018-18509)