openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:1833-1
Rating:             important
References:         #1098998 
Cross-References:   CVE-2018-12359 CVE-2018-12360 CVE-2018-12361
                    CVE-2018-12362 CVE-2018-12363 CVE-2018-12364
                    CVE-2018-12365 CVE-2018-12366 CVE-2018-12367
                    CVE-2018-12369 CVE-2018-12371 CVE-2018-5156
                    CVE-2018-5187 CVE-2018-5188
Affected Products:
                    openSUSE Leap 42.3
                    openSUSE Leap 15.0
______________________________________________________________________________

   An update that fixes 14 vulnerabilities is now available.

Description:

   This security update for MozillaFirefox to version 60.1.0esr fixes
   multiple issues.

   Security issues fixed (MFSA 2018-16, boo#1098998):

   - CVE-2018-12359: Buffer overflow using computed size of canvas element
   - CVE-2018-12360: Use-after-free when using focus()
   - CVE-2018-12361: Integer overflow in SwizzleData
   - CVE-2018-12362: Integer overflow in SSSE3 scaler
   - CVE-2018-5156: Media recorder segmentation fault when track type is
     changed during capture
   - CVE-2018-12363: Use-after-free when appending DOM nodes
   - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
   - CVE-2018-12365: Compromised IPC child process can list local filenames
   - CVE-2018-12371: Integer overflow in Skia library during edge builder
     allocation
   - CVE-2018-12366: Invalid data handling during QCMS transformations
   - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming
   - CVE-2018-12369: WebExtension security permission checks bypassed by
     embedded experiments
   - CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR
     60.1
   - CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1,
     and Firefox ESR 52.9

   Other issues fixed:

   - various stability and regression fixes
   - do not disable system installed unsigned language packs (bmo#1464766)


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-676=1

   - openSUSE Leap 15.0:

      zypper in -t patch openSUSE-2018-676=1



Package List:

   - openSUSE Leap 42.3 (x86_64):

      MozillaFirefox-60.1.0-106.1
      MozillaFirefox-branding-upstream-60.1.0-106.1
      MozillaFirefox-buildsymbols-60.1.0-106.1
      MozillaFirefox-debuginfo-60.1.0-106.1
      MozillaFirefox-debugsource-60.1.0-106.1
      MozillaFirefox-devel-60.1.0-106.1
      MozillaFirefox-translations-common-60.1.0-106.1
      MozillaFirefox-translations-other-60.1.0-106.1

   - openSUSE Leap 15.0 (x86_64):

      MozillaFirefox-60.1.0-lp150.3.11.1
      MozillaFirefox-branding-upstream-60.1.0-lp150.3.11.1
      MozillaFirefox-buildsymbols-60.1.0-lp150.3.11.1
      MozillaFirefox-debuginfo-60.1.0-lp150.3.11.1
      MozillaFirefox-debugsource-60.1.0-lp150.3.11.1
      MozillaFirefox-devel-60.1.0-lp150.3.11.1
      MozillaFirefox-translations-common-60.1.0-lp150.3.11.1
      MozillaFirefox-translations-other-60.1.0-lp150.3.11.1


References:

   https://www.suse.com/security/cve/CVE-2018-12359.html
   https://www.suse.com/security/cve/CVE-2018-12360.html
   https://www.suse.com/security/cve/CVE-2018-12361.html
   https://www.suse.com/security/cve/CVE-2018-12362.html
   https://www.suse.com/security/cve/CVE-2018-12363.html
   https://www.suse.com/security/cve/CVE-2018-12364.html
   https://www.suse.com/security/cve/CVE-2018-12365.html
   https://www.suse.com/security/cve/CVE-2018-12366.html
   https://www.suse.com/security/cve/CVE-2018-12367.html
   https://www.suse.com/security/cve/CVE-2018-12369.html
   https://www.suse.com/security/cve/CVE-2018-12371.html
   https://www.suse.com/security/cve/CVE-2018-5156.html
   https://www.suse.com/security/cve/CVE-2018-5187.html
   https://www.suse.com/security/cve/CVE-2018-5188.html
   https://bugzilla.suse.com/1098998

--

openSUSE: 2018:1833-1: important: MozillaFirefox

June 28, 2018
An update that fixes 14 vulnerabilities is now available.

Description

This security update for MozillaFirefox to version 60.1.0esr fixes multiple issues. Security issues fixed (MFSA 2018-16, boo#1098998): - CVE-2018-12359: Buffer overflow using computed size of canvas element - CVE-2018-12360: Use-after-free when using focus() - CVE-2018-12361: Integer overflow in SwizzleData - CVE-2018-12362: Integer overflow in SSSE3 scaler - CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture - CVE-2018-12363: Use-after-free when appending DOM nodes - CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins - CVE-2018-12365: Compromised IPC child process can list local filenames - CVE-2018-12371: Integer overflow in Skia library during edge builder allocation - CVE-2018-12366: Invalid data handling during QCMS transformations - CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming - CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments - CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1 - CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Other issues fixed: - various stability and regression fixes - do not disable system installed unsigned language packs (bmo#1464766)

 

Patch

Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 42.3: zypper in -t patch openSUSE-2018-676=1 - openSUSE Leap 15.0: zypper in -t patch openSUSE-2018-676=1


Package List

- openSUSE Leap 42.3 (x86_64): MozillaFirefox-60.1.0-106.1 MozillaFirefox-branding-upstream-60.1.0-106.1 MozillaFirefox-buildsymbols-60.1.0-106.1 MozillaFirefox-debuginfo-60.1.0-106.1 MozillaFirefox-debugsource-60.1.0-106.1 MozillaFirefox-devel-60.1.0-106.1 MozillaFirefox-translations-common-60.1.0-106.1 MozillaFirefox-translations-other-60.1.0-106.1 - openSUSE Leap 15.0 (x86_64): MozillaFirefox-60.1.0-lp150.3.11.1 MozillaFirefox-branding-upstream-60.1.0-lp150.3.11.1 MozillaFirefox-buildsymbols-60.1.0-lp150.3.11.1 MozillaFirefox-debuginfo-60.1.0-lp150.3.11.1 MozillaFirefox-debugsource-60.1.0-lp150.3.11.1 MozillaFirefox-devel-60.1.0-lp150.3.11.1 MozillaFirefox-translations-common-60.1.0-lp150.3.11.1 MozillaFirefox-translations-other-60.1.0-lp150.3.11.1


References

https://www.suse.com/security/cve/CVE-2018-12359.html https://www.suse.com/security/cve/CVE-2018-12360.html https://www.suse.com/security/cve/CVE-2018-12361.html https://www.suse.com/security/cve/CVE-2018-12362.html https://www.suse.com/security/cve/CVE-2018-12363.html https://www.suse.com/security/cve/CVE-2018-12364.html https://www.suse.com/security/cve/CVE-2018-12365.html https://www.suse.com/security/cve/CVE-2018-12366.html https://www.suse.com/security/cve/CVE-2018-12367.html https://www.suse.com/security/cve/CVE-2018-12369.html https://www.suse.com/security/cve/CVE-2018-12371.html https://www.suse.com/security/cve/CVE-2018-5156.html https://www.suse.com/security/cve/CVE-2018-5187.html https://www.suse.com/security/cve/CVE-2018-5188.html https://bugzilla.suse.com/1098998--


Severity
Announcement ID: openSUSE-SU-2018:1833-1
Rating: important
Affected Products: openSUSE Leap 42.3 openSUSE Leap 15.0

Related News

6.EmailConnection Touch Esm H320
2 - 3 min read
Recent security updates for Ubuntu and Debian have been released to address vulnerabilities in Thunderbird, the popular open-source mail and
30.Lock Globe Motherboard Esm H320
1 - 2 min read
As cybersecurity practitioners, we are no strangers to the constant threat of malicious actors and the importance of remaining vigilant to protect
22.Lock ScreenEffect Esm H320
1 - 2 min read
EndeavorOS Gemini is a captivating and charming desktop operating system based on Arch Linux. The new release includes a kernel upgrade, 3D graphics
25.@Sign Hook Keyboard Esm H320
1 min read
Cyber risk is increasing for individuals and organizations, making flexible and robust solutions for identifying spam and malware increasingly
19.Laptop Bed Esm H320
2 - 3 min read
The recently released Linux Kernel 6.9 brings forth a blend of crucial upgrades and enhancements, catering to the ever-evolving needs of the Linux
4.Lock AbstractDigital Esm H320
1 - 2 min read
Nmap 7.95 introduces myriad enhancements, primarily focusing on OS and service detection signatures. This reflects the dedication of the Nmap
5.ShakingHands Esm H320
3 - 5 min read
There has been a promising shift in the tech industry, with major companies pledging to release products with built-in security features. This
18.WifiCutout Landscape Esm H320
2 - 3 min read
A novel attack called TunnelVision has been discovered. It compromises the security of virtually all VPN apps, rendering their purpose useless. The

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved