SUSE-SU-2018:2298-1: important: Security update for MozillaFirefox

sle-security-updates at sle-security-updates at
Fri Aug 10 07:08:05 MDT 2018

   SUSE Security Update: Security update for MozillaFirefox

Announcement ID:    SUSE-SU-2018:2298-1
Rating:             important
References:         #1092548 #1096449 #1098998 
Cross-References:   CVE-2018-12359 CVE-2018-12360 CVE-2018-12362
                    CVE-2018-12363 CVE-2018-12364 CVE-2018-12365
                    CVE-2018-12366 CVE-2018-12368 CVE-2018-5150
                    CVE-2018-5154 CVE-2018-5155 CVE-2018-5156
                    CVE-2018-5157 CVE-2018-5158 CVE-2018-5159
                    CVE-2018-5168 CVE-2018-5178 CVE-2018-5183
                    CVE-2018-5188 CVE-2018-6126
Affected Products:
                    SUSE Linux Enterprise Module for Desktop Applications 15

   An update that fixes 20 vulnerabilities is now available.


   This update for MozillaFirefox to the 52.9 ESR release fixes the following

   These security issues were fixed:

   - Firefox ESR 52.9:
   - CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1,
     and Firefox ESR 52.9 (bsc#1098998).
   - CVE-2018-12368 No warning when opening executable SettingContent-ms
     files (bsc#1098998).
   - CVE-2018-12366 Invalid data handling during QCMS transformations
   - CVE-2018-12365 Compromised IPC child process can list local filenames
   - CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins
   - CVE-2018-12363 Use-after-free when appending DOM nodes (bsc#1098998).
   - CVE-2018-12362 Integer overflow in SSSE3 scaler (bsc#1098998).
   - CVE-2018-12360 Use-after-free when using focus() (bsc#1098998).
   - CVE-2018-5156 Media recorder segmentation fault when track type is
     changed during capture (bsc#1098998).
   - CVE-2018-12359 Buffer overflow using computed size of canvas element

   - Firefox ESR 52.8:
   - CVE-2018-6126: Prevent heap buffer overflow in rasterizing paths in SVG
     with Skia (bsc#1096449).
   - CVE-2018-5183: Backport critical security fixes in Skia (bsc#1092548).
   - CVE-2018-5154: Use-after-free with SVG animations and clip paths
   - CVE-2018-5155: Use-after-free with SVG animations and text paths
   - CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF
     files (bsc#1092548).
   - CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
   - CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
   - CVE-2018-5168: Lightweight themes can be installed without user
     interaction (bsc#1092548).
   - CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion
     through legacy extension (bsc#1092548).
   - CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR
     52.8 (bsc#1092548).

   These non-security issues were fixed:

   - Various stability and regression fixes
   - Performance improvements to the Safe Browsing service to avoid slowdowns
     while updating site classification data

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Desktop Applications 15:

      zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-1536=1

Package List:

   - SUSE Linux Enterprise Module for Desktop Applications 15 (aarch64 ppc64le s390x x86_64):


   - SUSE Linux Enterprise Module for Desktop Applications 15 (aarch64 ppc64le x86_64):



More information about the sle-security-updates mailing list