This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 68.5.0 ESR
* Fixed: Various stability and security fixes
- Mozilla Firefox ESR68.5
MFSA 2020-06 (bsc#1163368)
* CVE-2020-6796 (bmo#1610426)
Missing bounds check on shared memory read in the parent
process
* CVE-2020-6797 (bmo#1596668)
Extensions granted downloads.open permission could open
arbitrary applications on Mac OSX
* CVE-2020-6798 (bmo#1602944)
Incorrect parsing of template tag could result in JavaScript
injection
* CVE-2020-6799 (bmo#1606596)
Arbitrary code execution when opening pdf links from other
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 68.4.1 ESR
* Fixed: Security fix
MFSA 2020-03 (bsc#1160498)
* CVE-2019-17026 (bmo#1607443)
IonMonkey type confusion with StoreElementHole and
FallibleStoreElement
- Firefox Extended Support Release 68.4.0 ESR
* Fixed: Various security fixes
MFSA 2020-02 (bsc#1160305)
* CVE-2019-17015 (bmo#1599005)
Memory corruption in parent process during new content
process initialization on Windows
* CVE-2019-17016 (bmo#1599181)
Bypass of @namespace CSS sanitization during pasting
* CVE-2019-17017 (bmo#1603055)
Type Confus
This update for MozillaFirefox fixes the following issues:
Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)
Security issues fixed:
- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments
in WebRTC code (bmo#1580156)
- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a
block cipher (bmo#1586176)
- CVE-2019-17009: Fixed an issue where updater temporary files accessible to
unprivileged processes (bmo#1510494)
- CVE-2019-17010: Fixed a use-after-free when performing device orientation
Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:
Changes in MozillaFirefox:
Security issues fixed:
- CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
- CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
- CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
- CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
- CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
- CVE-2019-11761: Fixed an unintended access to a privileged JSONView o
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-201
This update for MozillaFirefox, mozilla-nss fixes the following issues:
MozillaFirefox to version ESR 60.8:
- CVE-2019-9811: Sandbox escape via installation of malicious language pack (bsc#1140868).
- CVE-2019-11711: Script injection within domain through inner window reuse (bsc#1140868).
- CVE-2019-11712: Cross-origin POST requests can be made with NPAPI plugins by following 308 redirects (bsc#1140868).
- CVE-2019-11713: Use-after-free with HTTP/2 cached stream (bsc#1140868).
- CVE-2019-11729: Empty or malformed p256-ECDH public keys may trigger a segmentation fault (bsc#1140868).
- CVE-2019-11715: HTML parsing error can contribute to cont
This update for MozillaFirefox fixes the following issues:
- Mozilla Firefox Firefox 60.7.2
MFSA 2019-19 (bsc#1138872)
- CVE-2019-11708: Fix sandbox escape using Prompt:Open.
* Insufficient vetting of parameters passed with the Prompt:Open IPC
message between child and parent processes could result in the non-sandboxed
parent process opening web content chosen by a compromised child process.
When combined with additional vulnerabilities this could result in executing
arbitrary code on the user's computer.
This update for MozillaFirefox to version 60.7.1 fixes the following issues:
Security issue fixed:
- CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614)
Other issues addressed:
- Added the new Mozilla's GPG key expiring on 2021-05-29 to the mozilla.keyring file
- Fixed broken language plugins (bsc#1137792)
This update for MozillaFirefox fixes the following issues:
Security issues fixed:
- CVE-2019-11691: Use-after-free in XMLHttpRequest
- CVE-2019-11692: Use-after-free removing listeners in the event listener manager
- CVE-2019-11693: Buffer overflow in WebGL bufferdata on Linux
- CVE-2019-11694: Uninitialized memory memory leakage in Windows sandbox
- CVE-2019-11698: Theft of user history data through drag and drop of hyperlinks to and from bookmarks
- CVE-2019-7317: Use-after-free in png_image_free of libpng library
- CVE-2019-9800: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7
- CVE-2019-9815: Disable hyperthreading on conten
This update for MozillaFirefox to version ESR 60.6.1 fixes the following issues:
Security issuess addressed:
- update to Firefox ESR 60.6.1 (bsc#1130262):
- CVE-2019-9813: Fixed Ionmonkey type confusion with __proto__ mutations
- CVE-2019-9810: Fixed IonMonkey MArraySlice incorrect alias information
- Update to Firefox ESR 60.6 (bsc#1129821):
- CVE-2018-18506: Fixed an issue with Proxy Auto-Configuration file
- CVE-2019-9801: Fixed an issue which could allow Windows programs to be exposed to web content
- CVE-2019-9788: Fixed multiple memory safety bugs
- CVE-2019-9790: Fixed a Use-after-free vulnerability when removing in-use DOM el
Security update for MozillaFirefox, mozilla-nspr and mozilla-nss
This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues:
Issues fixed in MozillaFirefox:
- Update to Firefox ESR 60.4 (bsc#1119105)
- CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
- CVE-2018-18492: Fixed a use-after-free with select element
- CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia
- CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries
to steal cross-origin URLs
- CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images
- CVE-2018-12405: Fixe
This update for MozillaFirefox fixes the following issues:
Security issues fixed:
- Update to Mozilla Firefox 60.3.0esr: MFSA 2018-27 (bsc#1112852)
- CVE-2018-12392: Crash with nested event loops.
- CVE-2018-12393: Integer overflow during Unicode conversion while loading JavaScript.
- CVE-2018-12395: WebExtension bypass of domain restrictions through header rewriting.
- CVE-2018-12396: WebExtension content scripts can execute in disallowed contexts.
- CVE-2018-12397: WebExtension local file access vulnerability.
- CVE-2018-12389: Memory safety bugs fixed in Firefox ESR 60.3.
- CVE-2018-12390: Memory safety bugs fixed in Firefox 63 and Firef
This update for MozillaFirefox to 60.2.2ESR fixes the following issues:
Security issues fixed:
MFSA 2018-24:
- CVE-2018-12386: A Type confusion in JavaScript allowed remote code execution (bsc#1110506)
- CVE-2018-12387: Array.prototype.push stack pointer vulnerability may have enabled exploits in the sandboxed content process (bsc#1110507)
MFSA 2018-23:
- CVE-2018-12385: Fixed a crash in TransportSecurityInfo due to cached data (bsc#1109363)
- CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)
Non security issues fixed:
- Avoid undefined behavior in IPC fd-passing code (b
This update for MozillaFirefox to ESR 60.2 fixes several issues.
These general changes are part of the version 60 release.
- New browser engine with speed improvements
- Redesigned graphical user interface elements
- Unified address and search bar for new installations
- New tab page listing top visited, recently visited and recommended pages
- Support for configuration policies in enterprise deployments via JSON files
- Support for Web Authentication, allowing the use of USB tokens for
authentication to web sites
The following changes affect compatibility:
- Now exclusively supports extensions built using the WebExtension API.
- Unsupp
This update for MozillaFirefox to the 52.9 ESR release fixes the following issues:
These security issues were fixed:
- Firefox ESR 52.9:
- CVE-2018-5188 Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 (bsc#1098998).
- CVE-2018-12368 No warning when opening executable SettingContent-ms files (bsc#1098998).
- CVE-2018-12366 Invalid data handling during QCMS transformations (bsc#1098998).
- CVE-2018-12365 Compromised IPC child process can list local filenames (bsc#1098998).
- CVE-2018-12364 CSRF attacks through 307 redirects and NPAPI plugins (bsc#1098998).
- CVE-2018-12363 Use-after-free when appending DOM node