Security update for MozillaFirefox
Announcement ID: | SUSE-SU-2018:3749-2 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves seven vulnerabilities can now be installed.
Description:
This update for MozillaFirefox fixes the following issues:
Security issues fixed:
- Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
- CVE-2018-12392: Crash with nested event loops.
- CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
- CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
- CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
- CVE-2018-12397: WebExtension local file access vulnerability.
- CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
- CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firefox ESR 60.3.
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Desktop 12 SP4
zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2018-2648=1
-
SUSE Linux Enterprise Software Development Kit 12 SP4
zypper in -t patch SUSE-SLE-SDK-12-SP4-2018-2648=1
-
SUSE Linux Enterprise High Performance Computing 12 SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-2018-2648=1
-
SUSE Linux Enterprise Server 12 SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-2018-2648=1
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4
zypper in -t patch SUSE-SLE-SERVER-12-SP4-2018-2648=1
Package List:
-
SUSE Linux Enterprise Desktop 12 SP4 (x86_64)
- MozillaFirefox-translations-common-60.3.0-109.50.2
- MozillaFirefox-60.3.0-109.50.2
- MozillaFirefox-debuginfo-60.3.0-109.50.2
- MozillaFirefox-debugsource-60.3.0-109.50.2
-
SUSE Linux Enterprise Software Development Kit 12 SP4 (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-devel-60.3.0-109.50.2
- MozillaFirefox-debuginfo-60.3.0-109.50.2
- MozillaFirefox-debugsource-60.3.0-109.50.2
-
SUSE Linux Enterprise High Performance Computing 12 SP4 (aarch64 x86_64)
- MozillaFirefox-translations-common-60.3.0-109.50.2
- MozillaFirefox-60.3.0-109.50.2
- MozillaFirefox-debuginfo-60.3.0-109.50.2
- MozillaFirefox-debugsource-60.3.0-109.50.2
-
SUSE Linux Enterprise Server 12 SP4 (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-translations-common-60.3.0-109.50.2
- MozillaFirefox-60.3.0-109.50.2
- MozillaFirefox-debuginfo-60.3.0-109.50.2
- MozillaFirefox-debugsource-60.3.0-109.50.2
-
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64)
- MozillaFirefox-translations-common-60.3.0-109.50.2
- MozillaFirefox-60.3.0-109.50.2
- MozillaFirefox-debuginfo-60.3.0-109.50.2
- MozillaFirefox-debugsource-60.3.0-109.50.2
References:
- https://www.suse.com/security/cve/CVE-2018-12389.html
- https://www.suse.com/security/cve/CVE-2018-12390.html
- https://www.suse.com/security/cve/CVE-2018-12392.html
- https://www.suse.com/security/cve/CVE-2018-12393.html
- https://www.suse.com/security/cve/CVE-2018-12395.html
- https://www.suse.com/security/cve/CVE-2018-12396.html
- https://www.suse.com/security/cve/CVE-2018-12397.html
- https://bugzilla.suse.com/show_bug.cgi?id=1112852