-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT Security Bulletin
Firefox 64 security released
12 December 2018
AusCERT Security Bulletin Summary
Product: Mozilla Firefox
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Unauthorised Access -- Remote with User Interaction
CVE Names: CVE-2018-18498 CVE-2018-18497 CVE-2018-18496
CVE-2018-18495 CVE-2018-18494 CVE-2018-18493
CVE-2018-18492 CVE-2018-17466 CVE-2018-12407
Member content until: Friday, January 11 2019
Mozilla have released Firefox 64 with multiple security fixes. 
Mozilla advises that the following vulnerabilities have been
"# CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11
Reporter: Omair working with iDefense Labs
A buffer overflow occurs when drawing and validating elements with the ANGLE
graphics library, used for WebGL content, when working with the VertexBuffer11
module. This results in a potentially exploitable crash.
# CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with
A buffer overflow and out-of-bounds read can occur in TextureStorage11 within
the ANGLE graphics library, used for WebGL content. This results in a
potentially exploitable crash.
# CVE-2018-18492: Use-after-free with select element
A use-after-free vulnerability can occur after deleting a selection element due
to a weak reference to the select element in the options collection. This
results in a potentially exploitable crash.
# CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
Reporter: Atte Kettunen
A buffer overflow can occur in the Skia library during buffer offset
calculations with hardware accelerated canvas 2D actions due to the use of
32-bit calculations instead of 64-bit. This results in a potentially
# CVE-2018-18494: Same-origin policy violation using location attribute and
performance.getEntries to steal cross-origin URLs
Reporter: James Lee of Kryptos Logic
A same-origin policy violation allowing the theft of cross-origin URL entries
site using performance.getEntries(). This is a same-origin policy violation and
could allow for data theft.
# CVE-2018-18495: WebExtension content scripts can be loaded in about: pages
WebExtension content scripts can be loaded into about: pages in some
circumstances, in violation of the permissions granted to extensions. This
could allow an extension to interfere with the loading and usage of these pages
and use capabilities that were intended to be restricted from extensions.
# CVE-2018-18496: Embedded feed preview page can be abused for clickjacking
Reporter: Abdulrahman Alqabandi
When the RSS Feed preview about:feeds page is framed within another page, it
can be used in concert with scripted content for a clickjacking attack that
confuses users into downloading and executing an executable file from a
Note: This issue only affects Windows operating systems. Other operating
systems are not affected.
# CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators
Reporter: Rob Wu
Limitations on the URIs allowed to WebExtensions by the browser.windows.create
API can be bypassed when a pipe in the URL field is used within the extension
to load multiple pages as a single argument. This could allow a malicious
WebExtension to opened privileged about: or file: locations.
# CVE-2018-18498: Integer overflow when calculating buffer sizes for images
Reporter: r [sic]
A potential vulnerability leading to an integer overflow can occur during
buffer size calculations for images when a raw value is used instead of the
checked value. This can lead to an out-of-bounds write.
# CVE-2018-12406: Memory safety bugs fixed in Firefox 64
Reporter: Mozilla developers and community
Mozilla developers and community members Alex Gaynor, Andr? Bargull, Boris
Zbarsky, Christian Holler, Jan de Mooij, Jason Kratzer, Jed Davis, Philipp,
Ronald Crane, Natalia Csoregi, and Paul Theriault reported memory safety bugs
present in Firefox 63. Some of these bugs showed evidence of memory corruption
and we presume that with enough effort that some of these could be exploited to
run arbitrary code.
# CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4
Reporter: Mozilla developers and community
Mozilla developers and community members Christian Holler, Diego Calleja,
Andrew McCreight, Jon Coppeard, Natalia Csoregi, Nicolas B. Pierron, and Tyson
Smith reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3.
Some of these bugs showed evidence of memory corruption and we presume that
with enough effort that some of these could be exploited to run arbitrary code."
Mozilla advises updating to Firefox version 64 to address these
 Mozilla Foundation Security Advisory 2018-29
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: email@example.com
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----