Security update for MozillaFirefox
Announcement ID: | SUSE-SU-2019:14124-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves 12 vulnerabilities can now be installed.
Description:
This update for MozillaFirefox to version ESR 60.8 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
- CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
- CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
- CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
- CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
- CVE-2019-11715: HTML parsing error can contribute to content XSS (bsc#1140868).
- CVE-2019-11717: Caret character improperly escaped in origins (bsc#1140868).
- CVE-2019-11719: Out-of-bounds read when importing curve25519 private key (bsc#1140868).
- CVE-2019-11730: Same-origin policy treats all files in a directory as having the same-origin (bsc#1140868).
- CVE-2019-11709: Multiple Memory safety bugs fixed (bsc#1140868).
- CVE-2019-11708: Fix sandbox escape using Prompt:Open (bsc#1138872).
- CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)
Non-security issues fixed:
- Fix broken language plugins (bsc#1137792)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 11 SP4 LTSS 11-SP4
zypper in -t patch slessp4-MozillaFirefox-14124=1
-
SUSE Linux Enterprise Server 11 SP4
zypper in -t patch slessp4-MozillaFirefox-14124=1
Package List:
-
SUSE Linux Enterprise Server 11 SP4 LTSS 11-SP4 (x86_64)
- MozillaFirefox-translations-common-60.8.0esr-78.43.2
- MozillaFirefox-60.8.0esr-78.43.2
- MozillaFirefox-translations-other-60.8.0esr-78.43.2
-
SUSE Linux Enterprise Server 11 SP4 (x86_64)
- MozillaFirefox-translations-common-60.8.0esr-78.43.2
- MozillaFirefox-60.8.0esr-78.43.2
- MozillaFirefox-translations-other-60.8.0esr-78.43.2
References:
- https://www.suse.com/security/cve/CVE-2019-11707.html
- https://www.suse.com/security/cve/CVE-2019-11708.html
- https://www.suse.com/security/cve/CVE-2019-11709.html
- https://www.suse.com/security/cve/CVE-2019-11711.html
- https://www.suse.com/security/cve/CVE-2019-11712.html
- https://www.suse.com/security/cve/CVE-2019-11713.html
- https://www.suse.com/security/cve/CVE-2019-11715.html
- https://www.suse.com/security/cve/CVE-2019-11717.html
- https://www.suse.com/security/cve/CVE-2019-11719.html
- https://www.suse.com/security/cve/CVE-2019-11729.html
- https://www.suse.com/security/cve/CVE-2019-11730.html
- https://www.suse.com/security/cve/CVE-2019-9811.html
- https://bugzilla.suse.com/show_bug.cgi?id=1137792
- https://bugzilla.suse.com/show_bug.cgi?id=1138614
- https://bugzilla.suse.com/show_bug.cgi?id=1138872
- https://bugzilla.suse.com/show_bug.cgi?id=1140868