CVE-2017-5398

Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5405).

Also, the nss package has been updated to version 3.28.3, in which the Next Protocol Negotiation (NPN) extension has been replaced by the Application-Layer Protocol Negotiation (ALPN) extension and which now supports the Finite Field Diffie-Hellman Ephemeral Parameters (FFDHE) negotiation.

Due to the nss update, the sqlite3 package has been updated to version 3.10.2.

Additionally, an error in the nss package has been corrected, where it was failing to build against the system rootcerts package and instead was using a bundled version, which could have caused the rootcerts that NSS used to be outdated at times (mga#20053). The nss package has now been built against the latest rootcerts, which have also been updated.

JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. (CVE-2017-5400)

A crash triggerable by web content in which an ErrorResult references unassigned memory due to a logic error. The resulting crash may be exploitable. (CVE-2017-5401)

A use-after-free can occur when events are fired for a FontFace object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. (CVE-2017-5402)

A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. (CVE-2017-5404)

Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. (CVE-2017-5407)

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. (CVE-2017-5410)

Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. (CVE-2017-5408)

Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. (CVE-2017-5405)

Mozilla developers and community members Boris Zbarsky, Christian Holler, Honza Bambas, Jon Coppeard, Randell Jesup, André Bargull, Kan-Ru Chen, and Nathan Froyd reported memory safety bugs present in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. (CVE-2017-5398)

Updated iceape packages include security fixes from upstream Seamonkey and Firefox:

Multiple flaws were found in the way Iceape 2.48 processes various types of web content, where loading a web page containing malicious content could cause Iceape to crash, execute arbitrary code, or disclose sensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399, CVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404, CVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410, CVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414, CVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426, CVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421, CVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433, CVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439, CVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444, CVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449, CVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459, CVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465, CVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472, CVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753, CVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758, CVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765, CVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779, CVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787, CVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800, CVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805, CVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818, CVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826, CVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)

This update to Mozilla Thunderbird 45.8.0 fixes security issues and bugs.

The following security issues from advisory MFSA 2017-07 were fixed. (boo#1028391) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts:

• CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
• CVE-2017-5401: Memory Corruption when handling ErrorResult
• CVE-2017-5402: Use-after-free working with events in FontFace objects (bmo#1334876)
• CVE-2017-5404: Use-after-free working with ranges in selections
• CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
• CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
• CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
• CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports (bmo#1336699)
• CVE-2017-5398: Memory safety bugs fixed in Thunderbird 45.8

The following non-security issues were fixed:

• crash when viewing certain IMAP messages

This update to Mozilla Thunderbird 45.8.0 fixes security issues and bugs.

The following security issues from advisory MFSA 2017-07 were fixed. (boo#1028391) In general, these flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts:

• CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
• CVE-2017-5401: Memory Corruption when handling ErrorResult
• CVE-2017-5402: Use-after-free working with events in FontFace objects (bmo#1334876)
• CVE-2017-5404: Use-after-free working with ranges in selections
• CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
• CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
• CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
• CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports (bmo#1336699)
• CVE-2017-5398: Memory safety bugs fixed in Thunderbird 45.8

The following non-security issues were fixed:

• crash when viewing certain IMAP messages

This update to MozillaThunderbird 51.1.0 fixes security issues and bugs.

In general, these flaws cannot be exploited through email because scripting is disabled when reading mail, but are potentially risks in browser or browser-like contexts.

The following vulnerabilities were fixed: boo#1035082, MFSA 2017-13, boo#1028391, MFSA 2017-09)

• CVE-2017-5443: Out-of-bounds write during BinHex decoding
• CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1
• CVE-2017-5464: Memory corruption with accessibility and DOM manipulation
• CVE-2017-5465: Out-of-bounds read in ConvolvePixel
• CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL
• CVE-2017-5467: Memory corruption when drawing Skia content
• CVE-2017-5460: Use-after-free in frame selection
• CVE-2017-5449: Crash during bidirectional unicode manipulation with animation
• CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data
• CVE-2017-5447: Out-of-bounds read during glyph processing
• CVE-2017-5444: Buffer overflow while parsing application/http-index-format content
• CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content
• CVE-2017-5442: Use-after-free during style changes
• CVE-2017-5469: Potential Buffer overflow in flex-generated code
• CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing
• CVE-2017-5441: Use-after-free with selection during scroll events
• CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing
• CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing
• CVE-2017-5437: Vulnerabilities in Libevent library
• CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2
• CVE-2017-5435: Use-after-free during transaction processing in the editor
• CVE-2017-5434: Use-after-free during focus handling
• CVE-2017-5433: Use-after-free in SMIL animation functions
• CVE-2017-5432: Use-after-free in text input selection
• CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1
• CVE-2017-5459: Buffer overflow in WebGL
• CVE-2017-5454; Sandbox escape allowing file system read access through file picker
• CVE-2017-5451: Addressbar spoofing with onblur event
• CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
• CVE-2017-5401: Memory Corruption when handling ErrorResult
• CVE-2017-5402: Use-after-free working with events in FontFace objects
• CVE-2017-5403: Use-after-free using addRange to add range to an incorrect root object
• CVE-2017-5404: Use-after-free working with ranges in selections
• CVE-2017-5406: Segmentation fault in Skia with canvas operations
• CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
• CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
• CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
• CVE-2017-5412: Buffer overflow read in SVG filters
• CVE-2017-5413: Segmentation fault during bidirectional operations
• CVE-2017-5414: File picker can choose incorrect default directory
• CVE-2017-5416: Null dereference crash in HttpChannel
• CVE-2017-5426: Gecko Media Plugin sandbox is not started if seccomp-bpf filter is running
• CVE-2017-5418: Out of bounds read when parsing HTTP digest authorization responses
• CVE-2017-5419: Repeated authentication prompts lead to DOS attack
• CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports
• CVE-2017-5421: Print preview spoofing
• CVE-2017-5422: DOS attack by using view-source: protocol repeatedly in one hyperlink
• CVE-2017-5399: Memory safety bugs fixed in Thunderbird 52
• CVE-2017-5398: Memory safety bugs fixed in Thunderbird 52 and Thunderbird 45.8

The following non-security changes are included:

• Background images not working and other issues related to embedded images when composing email have been fixed
• Google Oauth setup can sometimes not…

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the MozillaThunderbird-91.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox to ESR 45.8 fixes the following issues:

Security issues fixed (bsc#1028391):

• CVE-2017-5402: Use-after-free working with events in FontFace objects
• CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
• CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
• CVE-2017-5401: Memory Corruption when handling ErrorResult
• CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
• CVE-2017-5404: Use-after-free working with ranges in selections
• CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports
• CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
• CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service
• CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8

This update for MozillaFirefox to ESR 45.8 fixes the following issues:

Security issues fixed (bsc#1028391):

• CVE-2017-5402: Use-after-free working with events in FontFace objects
• CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping
• CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP
• CVE-2017-5401: Memory Corruption when handling ErrorResult
• CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters
• CVE-2017-5404: Use-after-free working with ranges in selections
• CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports
• CVE-2017-5408: Cross-origin reading of video captions in violation of CORS
• CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service
• CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8

Bugfixes:

• fix crashes on Itanium (bsc#1027527)

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to bypass same origin restrictions, obtain sensitive information, spoof the addressbar, spoof the print dialog, cause a denial of service via application crash or hang, or execute arbitrary code. (CVE-2017-5398, CVE-2017-5399, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5403, CVE-2017-5404, CVE-2017-5405, CVE-2017-5406, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410, CVE-2017-5412, CVE-2017-5413, CVE-2017-5414, CVE-2017-5415, CVE-2017-5416, CVE-2017-5417, CVE-2017-5418, CVE-2017-5419, CVE-2017-5420, CVE-2017-5421, CVE-2017-5422, CVE-2017-5426, CVE-2017-5427)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to bypass same origin restrictions, obtain sensitive information, cause a denial of service via application crash or hang, or execute arbitrary code. (CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402, CVE-2017-5404, CVE-2017-5405, CVE-2017-5407, CVE-2017-5408, CVE-2017-5410)