CVE-2019-9788

Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.

Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506).

Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788).

Use-after-free when removing in-use DOM elements (CVE-2019-9790).

Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791).

IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792).

Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793).

Type-confusion in IonMonkey JIT compiler (CVE-2019-9795).

Use-after-free with SMIL animation controller (CVE-2019-9796).

Use-after-free when removing in-use DOM elements. (CVE-2019-9790)

Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey. (CVE-2019-9791)

IonMonkey leaks JS_OPTIMIZED_OUT magic value to script. (CVE-2019-9792)

Improper bounds checks when Spectre mitigations are disabled. (CVE-2019-9793)

Command line arguments not discarded during execution. (CVE-2019-9794)

Type-confusion in IonMonkey JIT compiler. (CVE-2019-9795)

Use-after-free with SMIL animation controller. (CVE-2019-9796)

Windows programs that are not 'URL Handlers' are exposed to web content. (CVE-2019-9801)

Proxy Auto-Configuration file can define localhost access to be proxied. (CVE-2018-18506)

Memory safety bugs fixed in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. (CVE-2019-9788)

IonMonkey MArraySlice has incorrect alias information. (CVE-2019-9810)

Ionmonkey type confusion with proto mutations. (CVE-2019-9813)

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 60.6.1esr / MFSA 2019-10 (bsc#1130262)

• CVE-2019-9810: IonMonkey MArraySlice has incorrect alias information
• CVE-2019-9813: Ionmonkey type confusion with proto mutations

Mozilla Firefox was updated to 60.6.0esr / MFSA 2019-08 (boo#1129821)

• CVE-2019-9790: Use-after-free when removing in-use DOM elements
• CVE-2019-9791: Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey
• CVE-2019-9792: IonMonkey leaks JS_OPTIMIZED_OUT magic value to script
• CVE-2019-9793: Improper bounds checks when Spectre mitigations are disabled
• CVE-2019-9794: Command line arguments not discarded during execution
• CVE-2019-9795: Type-confusion in IonMonkey JIT compiler
• CVE-2019-9796: Use-after-free with SMIL animation controller
• CVE-2018-18506: Proxy Auto-Configuration file can define localhost access to be proxied
• CVE-2019-9788: Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6

Mozilla Firefox 60.5.2esr also had one change:

• Fix a frequent crash when reading various Reuters news articles.

This update for MozillaThunderbird fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to MozillaThunderbird 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

These are all security issues fixed in the MozillaFirefox-92.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for MozillaFirefox fixes the following issues:

Security issuess addressed:

• update to Firefox ESR 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to Firefox ESR 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to Firefox ESR 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

• Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

This update for MozillaThunderbird to version 60.5.1 fixes the following issues:

Security issues fixed:

• Update to MozillaThunderbird 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to MozillaThunderbird 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to MozillaThunderbird 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

• CVE-2018-18509: Fixed a flaw which during verification of certain S/MIME signatures showing mistakenly that emails bring a valid sugnature. Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-11/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-06/

This update for MozillaFirefox to version ESR 60.6.1 fixes the following issues:

Security issuess addressed:

• update to Firefox ESR 60.6.1 (bsc#1130262):

• CVE-2019-9813: Fixed Ionmonkey type confusion with proto mutations

• CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information

• Update to Firefox ESR 60.6 (bsc#1129821):

• CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file

• CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content

• CVE-2019-9788: Fixed multiple memory safety bugs

• CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM elements

• CVE-2019-9791: Fixed an incorrect Type inference for constructors entered through on-stack replacement with IonMonkey

• CVE-2019-9792: Fixed an issue where IonMonkey leaks JS_OPTIMIZED_OUT magic value to script

• CVE-2019-9793: Fixed multiple improper bounds checks when Spectre mitigations are disabled

• CVE-2019-9794: Fixed an issue where command line arguments not discarded during execution

• CVE-2019-9795: Fixed a Type-confusion vulnerability in IonMonkey JIT compiler

• CVE-2019-9796: Fixed a Use-after-free vulnerability in SMIL animation controller

• Update to Firefox ESR 60.5.1 (bsc#1125330):

• CVE-2018-18356: Fixed a use-after-free vulnerability in the Skia library which can occur when creating a path, leading to a potentially exploitable crash.

• CVE-2019-5785: Fixed an integer overflow vulnerability in the Skia library which can occur after specific transform operations, leading to a potentially exploitable crash.

• CVE-2018-18335: Fixed a buffer overflow vulnerability in the Skia library which can occur with Canvas 2D acceleration on macOS. This issue was addressed by disabling Canvas 2D acceleration in Firefox ESR. Note: this does not affect other versions and platforms where Canvas 2D acceleration is already disabled by default.

Other issue addressed:

• Fixed an issue with MozillaFirefox-translations-common which was causing error on update (bsc#1127987).

Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-12/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/ Release notes: https://www.mozilla.org/en-US/security/advisories/mfsa2019-05/

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, denial of service via successive FTP authorization prompts or modal alerts, trick the user with confusing permission request prompts, obtain sensitive information, conduct social engineering attacks, or execute arbitrary code. (CVE-2019-9788, CVE-2019-9789, CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9797, CVE-2019-9799, CVE-2019-9802, CVE-2019-9805, CVE-2019-9806, CVE-2019-9807, CVE-2019-9808, CVE-2019-9809)

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. If a user were tricked in to opening a specially crafted website with Spectre mitigations disabled, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-9793)

It was discovered that Upgrade-Insecure-Requests was incorrectly enforced for same-origin navigation. An attacker could potentially exploit this to conduct machine-in-the-middle (MITM) attacks. (CVE-2019-9803)

USN-3918-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Ubuntu 14.04 LTS.

Original advisory details:

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, denial of service via successive FTP authorization prompts or modal alerts, trick the user with confusing permission request prompts, obtain sensitive information, conduct social engineering attacks, or execute arbitrary code. (CVE-2019-9788, CVE-2019-9789, CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9797, CVE-2019-9799, CVE-2019-9802, CVE-2019-9805, CVE-2019-9806, CVE-2019-9807, CVE-2019-9808, CVE-2019-9809)

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. If a user were tricked in to opening a specially crafted website with Spectre mitigations disabled, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-9793)

It was discovered that Upgrade-Insecure-Requests was incorrectly enforced for same-origin navigation. An attacker could potentially exploit this to conduct machine-in-the-middle (MITM) attacks. (CVE-2019-9803)

It was discovered that Thunderbird allowed PAC files to specify that requests to localhost are sent through the proxy to another server. If proxy auto-detection is enabled, an attacker could potentially exploit this to conduct attacks on local services and tools. (CVE-2018-18506)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2019-9788, CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9795, CVE-2019-9796, CVE-2019-9810, CVE-2019-9813)

A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled. If a user were tricked in to opening a specially crafted website in a browsing context with Spectre mitigations disabled, an attacker could potentially exploit this to cause a denial of service, or execute arbitrary code. (CVE-2019-9793)