ASB-2018.0305 - [Win][UNIX/Linux][BSD] Mozilla Firefox ESR: Multiple vulnerabilities 2018-12-12

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2018.0305
                         Firefox ESR 60.4 released
                             12 December 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Mozilla Firefox ESR
Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
                      BSD variants
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Denial of Service               -- Remote with User Interaction
                      Access Confidential Data        -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2018-18498 CVE-2018-18494 CVE-2018-18493
                      CVE-2018-18492 CVE-2018-17466 CVE-2018-12405
Member content until: Friday, January 11 2019
Reference:            ASB-2018.0304

OVERVIEW

        Mozilla have released Firefox Extended Support Release 60.4
        with multiple security fixes. [1]


IMPACT

        Mozilla advises that the following vulnerabilities have been addressed:
        
        "# CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with
        TextureStorage11
        
        Reporter: Omair
        Impact: high
        
        Description
        
        A buffer overflow and out-of-bounds read can occur in TextureStorage11 within
        the ANGLE graphics library, used for WebGL content. This results in a
        potentially exploitable crash.
        
        # CVE-2018-18492: Use-after-free with select element
        
        Reporter: Nils
        Impact: high
        
        Description
        
        A use-after-free vulnerability can occur after deleting a selection element due
        to a weak reference to the select element in the options collection. This
        results in a potentially exploitable crash.
        
        # CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
        
        Reporter: Atte Kettunen
        Impact: high
        
        Description
        
        A buffer overflow can occur in the Skia library during buffer offset
        calculations with hardware accelerated canvas 2D actions due to the use of
        32-bit calculations instead of 64-bit. This results in a potentially
        exploitable crash.
        
        # CVE-2018-18494: Same-origin policy violation using location attribute and
        performance.getEntries to steal cross-origin URLs
        
        Reporter: James Lee of Kryptos Logic
        Impact: high
        
        Description
        
        A same-origin policy violation allowing the theft of cross-origin URL entries
        when using the Javascript location property to cause a redirection to another
        site using performance.getEntries(). This is a same-origin policy violation and
        could allow for data theft.
        
        # CVE-2018-18498: Integer overflow when calculating buffer sizes for images
        
        Reporter: r
        Impact: low
        
        Description
        
        A potential vulnerability leading to an integer overflow can occur during
        buffer size calculations for images when a raw value is used instead of the
        checked value. This leads to a possible out-of-bounds write.
        
        # CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4
        
        Reporter: Mozilla developers and community
        Impact: critical
        
        Description
        
        Mozilla developers and community members Christian Holler, Diego Calleja,
        Andrew McCreight, Jon Coppeard, Natalia Csoregi, Nicolas B. Pierron, and Tyson
        Smith reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3.
        Some of these bugs showed evidence of memory corruption and we presume that
        with enough effort that some of these could be exploited to run arbitrary code."
        [1]


MITIGATION

        Mozilla advises updating Firefox Extended Support Release
        to version 60.4 to address these vulnerabilities. [1]


REFERENCES

        [1] Mozilla Foundation Security Advisory 2018-30
            https://www.mozilla.org/en-US/security/advisories/mfsa2018-30/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXBBTRGaOgq3Tt24GAQifYA//RkYd0xWbB91lYWbq/ViXTK8sOOXuqGZB
UUHITEpy6MydUVbh7/cejSC8VvugpAeofYlForKFOHB8ZNi5h+IDcokgK2ovJ64A
cIx2nnugJeC1uciK4fU8Yuu6vPUarvSo0e3FzdIyRI4O40VRRPczGwpDNkPKkOLD
7IRSr74wXImpvUN4MvAAwzcxD+hYB8yJClbMolF2vzsdR9LWWkcbfDi6574ubYfa
jfZVJDB07lq34C2woI1XMRu81L+bI0VNC65za+/+ASAKln7NtAahf5EWCXIov64B
gZR9jOLgezJ+WBhsQAGtkP3njnpZiP4qcDKoIU+oaJVFkdPvqmIRohXCDfDy3okz
LgiD3cmd0iyASFgfkgQRn5KGFydtoFVTBvzRVju8I9uF3BECMSNoQrNURSlPqkSc
d8CcWzttt4L9V3cEBtj6+Wcg0Lklf/TBsZeVwsxCu+fnuhVZ8oiflil58M2oWIwF
SZVd84RXU8hjnrQ7Ta+vGUB1XDQS7v2AGJxrETvtj9OfV+mEyc3uhrhIOYLRRfm8
5b/x0XxM3LJbldbD98G49Hr2CuckG0gpuaxnyGwnrPccBCwNK7A/0xL200M8N3He
ooapdhtu4w6s3qNjDKzm59G487+TfT18rBk9AcBx6kMsIgiW0j3IFIWv79F0qBwa
YpE27ChWgtc=
=FdII
-----END PGP SIGNATURE-----

« Back to bulletins