Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:
Changes in MozillaFirefox:
Security issues fixed:
- CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
- CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
- CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
- CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
- CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
- CVE-2019-11761: Fixed an unintended access to a privileged JSONView o
This update for MozillaFirefox to 68.1 fixes the following issues:
Security issues fixed:
- CVE-2019-9811: Fixed a sandbox escape via installation of malicious language pack. (bsc#1140868)
- CVE-2019-9812: Fixed a sandbox escape through Firefox Sync. (bsc#1149294)
- CVE-2019-11710: Fixed several memory safety bugs. (bsc#1140868)
- CVE-2019-11714: Fixed a potentially exploitable crash in Necko. (bsc#1140868)
- CVE-2019-11716: Fixed a sandbox bypass. (bsc#1140868)
- CVE-2019-11718: Fixed inadequate sanitation in the Activity Stream component. (bsc#1140868)
- CVE-2019-11720: Fixed a character encoding XSS vulnerability. (bsc#1140868)
- CVE-201
This update for MozillaFirefox to 60.2.2ESR fixes the following issues:
Security issues fixed:
MFSA 2018-24:
- CVE-2018-12386: A Type confusion in JavaScript allowed remote code execution (bsc#1110506)
- CVE-2018-12387: Array.prototype.push stack pointer vulnerability may have enabled exploits in the sandboxed content process (bsc#1110507)
MFSA 2018-23:
- CVE-2018-12385: Fixed a crash in TransportSecurityInfo due to cached data (bsc#1109363)
- CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)
Non security issues fixed:
- Avoid undefined behavior in IPC fd-passing code (b
This update for MozillaFirefox to ESR 60.2 fixes several issues.
These general changes are part of the version 60 release.
- New browser engine with speed improvements
- Redesigned graphical user interface elements
- Unified address and search bar for new installations
- New tab page listing top visited, recently visited and recommended pages
- Support for configuration policies in enterprise deployments via JSON files
- Support for Web Authentication, allowing the use of USB tokens for
authentication to web sites
The following changes affect compatibility:
- Now exclusively supports extensions built using the WebExtension API.
- Unsupp