Security update for MozillaFirefox

Announcement ID:	SUSE-SU-2019:3337-1
Rating:	important
References:	bsc#1157652 bsc#1158328
Cross-References:	CVE-2019-11745 CVE-2019-13722 CVE-2019-17005 CVE-2019-17008 CVE-2019-17009 CVE-2019-17010 CVE-2019-17011 CVE-2019-17012
CVSS scores:	CVE-2019-11745 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2019-11745 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-13722 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-13722 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2019-17005 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17005 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17008 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17008 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17009 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-17009 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2019-17010 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17010 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17011 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17011 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17012 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2019-17012 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:	Desktop Applications Module 15-SP1 Desktop Applications Module 15 SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise Real Time 15 SP1 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 Business Critical Linux 15-SP1 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Manager Proxy 4.0 SUSE Manager Retail Branch Server 4.0 SUSE Manager Server 4.0

An update that solves eight vulnerabilities can now be installed.

Description:

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)

Security issues fixed:

• CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
• CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments in WebRTC code (bmo#1580156)
• CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a block cipher (bmo#1586176)
• CVE-2019-17009: Fixed an issue where updater temporary files accessible to unprivileged processes (bmo#1510494)
• CVE-2019-17010: Fixed a use-after-free when performing device orientation checks (bmo#1581084)
• CVE-2019-17005: Fixed a buffer overflow in plain text serializer (bmo#1584170)
• CVE-2019-17011: Fixed a use-after-free when retrieving a document in antitracking (bmo#1591334)
• CVE-2019-17012: Fixed multiple memmory issues (bmo#1449736, bmo#1533957, bmo#1560667,bmo#1567209, bmo#1580288, bmo#1585760, bmo#1592502)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• Desktop Applications Module 15
  zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2019-3337=1
• Desktop Applications Module 15-SP1
  zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP1-2019-3337=1

Package List:

• Desktop Applications Module 15 (aarch64 ppc64le s390x x86_64)
  • MozillaFirefox-devel-68.3.0-3.62.2
  • MozillaFirefox-68.3.0-3.62.2
  • MozillaFirefox-debuginfo-68.3.0-3.62.2
  • MozillaFirefox-translations-other-68.3.0-3.62.2
  • MozillaFirefox-debugsource-68.3.0-3.62.2
  • MozillaFirefox-translations-common-68.3.0-3.62.2
• Desktop Applications Module 15-SP1 (aarch64 ppc64le s390x x86_64)
  • MozillaFirefox-68.3.0-3.62.2
  • MozillaFirefox-debuginfo-68.3.0-3.62.2
  • MozillaFirefox-translations-other-68.3.0-3.62.2
  • MozillaFirefox-debugsource-68.3.0-3.62.2
  • MozillaFirefox-translations-common-68.3.0-3.62.2
• Desktop Applications Module 15-SP1 (aarch64 ppc64le x86_64)
  • MozillaFirefox-devel-68.3.0-3.62.2

References:

• https://www.suse.com/security/cve/CVE-2019-11745.html
• https://www.suse.com/security/cve/CVE-2019-13722.html
• https://www.suse.com/security/cve/CVE-2019-17005.html
• https://www.suse.com/security/cve/CVE-2019-17008.html
• https://www.suse.com/security/cve/CVE-2019-17009.html
• https://www.suse.com/security/cve/CVE-2019-17010.html
• https://www.suse.com/security/cve/CVE-2019-17011.html
• https://www.suse.com/security/cve/CVE-2019-17012.html
• https://bugzilla.suse.com/show_bug.cgi?id=1157652
• https://bugzilla.suse.com/show_bug.cgi?id=1158328