SUSE-SU-2020:14456-1: moderate: Security update for MozillaFirefox

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:14456-1
Rating:             moderate
References:         #1173948 #1173991 #1174538 
Cross-References:   CVE-2020-15652 CVE-2020-15653 CVE-2020-15654
                    CVE-2020-15655 CVE-2020-15656 CVE-2020-15657
                    CVE-2020-15658 CVE-2020-15659 CVE-2020-6463
                    CVE-2020-6514
Affected Products:
                    SUSE Linux Enterprise Server 11-SP4-LTSS
                    SUSE Linux Enterprise Debuginfo 11-SP4
______________________________________________________________________________

   An update that fixes 10 vulnerabilities is now available.

Description:

   This update for MozillaFirefox fixes the following issues:

   - Fix broken translation-loading (boo#1173991)
     * allow addon sideloading
     * mark signatures for langpacks non-mandatory
     * do not autodisable user profile scopes
   - Google API key is not usable for geolocation service any more

   - Mozilla Firefox 78.1 ESR
     * Fixed: Various stability, functionality, and security fixe (MFSA
       2020-32) (bsc#1174538).
     * CVE-2020-15652 (bmo#1634872) Potential leak of redirect targets when
       loading scripts in a worker
     * CVE-2020-6514 (bmo#1642792) WebRTC data channel leaks internal address
       to peer
     * CVE-2020-15655 (bmo#1645204) Extension APIs could be used to bypass
       Same-Origin Policy
     * CVE-2020-15653 (bmo#1521542) Bypassing iframe sandbox when allowing
       popups
     * CVE-2020-6463 (bmo#1635293) Use-after-free in ANGLE
       gl::Texture::onUnbindAsSamplerTexture
     * CVE-2020-15656 (bmo#1647293) Type confusion for special arguments in
       IonMonkey
     * CVE-2020-15658 (bmo#1637745) Overriding file type when saving to disk
     * CVE-2020-15657 (bmo#1644954) DLL hijacking due to incorrect loading
       path
     * CVE-2020-15654 (bmo#1648333) Custom cursor can overlay user interface
     * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1643613, bmo#1644839,
       bmo#1645835, bmo#1646006, bmo#1646787, bmo#1649347, bmo#1650811,
       bmo#1651678) Memory safety bugs fixed in Firefox 79 and Firefox ESR
       78.1

   - Add sle11-icu-generation-python3.patch to fix icu-generation
     on big endian platforms

   - Mozilla Firefox 78.0.2 ESR
     * MFSA 2020-28 (bsc#1173948)
     * MFSA-2020-0003 (bmo#1644076) X-Frame-Options bypass using object or
       embed tags
     * Fixed: Fixed an accessibility regression in reader mode (bmo#1650922)
     * Fixed: Made the address bar more resilient to data corruption in the
       user profile (bmo#1649981)
     * Fixed: Fixed a regression opening certain external applications
       (bmo#1650162)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 11-SP4-LTSS:

      zypper in -t patch slessp4-MozillaFirefox-14456=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-MozillaFirefox-14456=1



Package List:

   - SUSE Linux Enterprise Server 11-SP4-LTSS (x86_64):

      MozillaFirefox-78.1.0-78.87.1
      MozillaFirefox-translations-common-78.1.0-78.87.1
      MozillaFirefox-translations-other-78.1.0-78.87.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (x86_64):

      MozillaFirefox-debuginfo-78.1.0-78.87.1


References:

   https://www.suse.com/security/cve/CVE-2020-15652.html
   https://www.suse.com/security/cve/CVE-2020-15653.html
   https://www.suse.com/security/cve/CVE-2020-15654.html
   https://www.suse.com/security/cve/CVE-2020-15655.html
   https://www.suse.com/security/cve/CVE-2020-15656.html
   https://www.suse.com/security/cve/CVE-2020-15657.html
   https://www.suse.com/security/cve/CVE-2020-15658.html
   https://www.suse.com/security/cve/CVE-2020-15659.html
   https://www.suse.com/security/cve/CVE-2020-6463.html
   https://www.suse.com/security/cve/CVE-2020-6514.html
   https://bugzilla.suse.com/1173948
   https://bugzilla.suse.com/1173991
   https://bugzilla.suse.com/1174538