CVE-2019-11707

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

The updated firefox packages fix a security vulnerability that's being exploited in the wild:

Type confusion in Array.pop. (CVE-2019-11707)

Updated thunderbird packages fix security vulnerabilities:

Type confusion in Array.pop. (CVE-2019-11707)

Sandbox escape using Prompt:Open. (CVE-2019-11708)

The updated packages fix security vulnerabilities:

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. (CVE-2019-11707)

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process. When combined with additional vulnerabilities this could result in executing arbitrary code on the user's computer. This vulnerability affects Firefox ESR < 60.7.2, Firefox < 67.0.4, and Thunderbird < 60.7.2. (CVE-2019-11708)

The mozjs60 package has been updated to version 60.9.0, fixing these issues and other bugs. The gjs package has been rebuilt against the updated mozjs60.

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox 60.7.1esr was released to address MFSA 2019-18 (boo#1138614)

• CVE-2019-11707: Fixed a type confusion in Array.pop

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).
• CVE-2019-11707: Fixed a type confusion in Array.pop (bsc#1138872).
• CVE-2019-11708: Fixed a sandbox escape using Prompt:Open (bsc#1138872).

This update was imported from the SUSE:SLE-15:Update update project.

This update for MozillaThunderbird fixes the following issues:

Mozilla Thunderbird was updated to 60.7.2 / MFSA 2019-20 (boo#1138872):

• CVE-2019-11707: Type confusion in Array.pop
• CVE-2019-11708: sandbox escape using Prompt:Open

Mozilla Thunderbird was updated to 60.7.1 / MFSA 2019-17 (boo#1137595):

• CVE-2019-11703: Heap buffer overflow in icalparser.c
• CVE-2019-11704: Heap buffer overflow in icalvalue.c
• CVE-2019-11705: Stack buffer overflow in icalrecur.c
• CVE-2019-11706: Type confusion in icalproperty.c

Also fixed: No prompt for smartcard PIN when S/MIME signing is used

Mozilla Thunderbird was updated to 60.7.0 / MFSA 2019-15 (boo#1135824):

• Attachment pane of Write window no longer focussed when attaching files using a keyboard shortcut

• CVE-2019-9815: Disable hyperthreading on content JavaScript threads on macOS

• CVE-2019-9816: Type confusion with object groups and UnboxedObjects

• CVE-2019-9817: Stealing of cross-domain images using canvas

• CVE-2019-9818 (Windows only): Use-after-free in crash generation server

• CVE-2019-9819: Compartment mismatch with fetch API

• CVE-2019-9820: Use-after-free of ChromeEventHandler by DocShell

• CVE-2019-11691: Use-after-free in XMLHttpRequest

• CVE-2019-11692: Use-after-free removing listeners in the event listener manager

• CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux

• CVE-2019-7317: Use-after-free in png_image_free of libpng library

• CVE-2019-9797: Cross-origin theft of images with createImageBitmap

• CVE-2018-18511: Cross-origin theft of images with ImageBitmapRenderingContext

• CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox

• CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks

• CVE-2019-5798: Out-of-bounds read in Skia

• CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7

• Disable building with LTO (boo#1133267).

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to version 60.7.1 fixes the following issues:

Security issue fixed:

• CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)

Other issue addressed:

• Fixed broken language plugins (bsc#1137792)

This update for MozillaFirefox to version ESR 60.8 fixes the following issues:

Security issues fixed:

• CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
• CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
• CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
• CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
• CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
• CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
• CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
• CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
• CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
• CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).
• CVE-2019-11708: Fix sandbox escape using Prompt:Open (bsc#1138872).
• CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)

Non-security issues fixed:

• Fix broken language plugins (bsc#1137792)

This update for MozillaFirefox to version 60.7.1 fixes the following issues:

Security issue fixed:

• CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)

Other issues addressed:

• Added the new Mozilla's GPG key expiring on 2021-05-29 to the mozilla.keyring file
• Fixed broken language plugins (bsc#1137792)

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• CVE-2019-11703: Fixed a heap-based buffer overflow in icalmemorystrdupanddequote() (bsc#1137595).
• CVE-2019-11704: Fixed a heap-based buffer overflow in parser_get_next_char() (bsc#1137595).
• CVE-2019-11705: Fixed a stack-based buffer overflow in icalrecur_add_bydayrules() (bsc#1137595).
• CVE-2019-11706: Fixed a type confusion in icaltimezone_get_vtimezone_properties() (bsc#1137595).
• CVE-2019-11707: Fixed a type confusion in Array.pop (bsc#1138872).
• CVE-2019-11708: Fixed a sandbox escape using Prompt:Open (bsc#1138872).

A type confusion bug was discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could exploit this by causing a denial of service, or executing arbitrary code.

A type confusion bug was discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could exploit this by causing a denial of service, or executing arbirary code. (CVE-2019-11707)

It was discovered that a sandboxed child process could open arbitrary web content in the parent process via the Prompt:Open IPC message. When combined with another vulnerability, an attacker could potentially exploit this to execute arbitrary code. (CVE-2019-11708)