Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.1303 SUSE-SU-2018:4236-2 Security update for MozillaFirefox, mo zilla-nspr and mozilla-nss 16 April 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: MozillaFirefox mozilla-nspr mozilla-nss Publisher: SUSE Operating System: SUSE Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-18498 CVE-2018-18494 CVE-2018-18493 CVE-2018-18492 CVE-2018-17466 CVE-2018-12405 CVE-2018-12404 CVE-2018-12384 CVE-2018-0495 Reference: ESB-2019.0080.2 ESB-2019.0010 ESB-2018.3904 ESB-2018.3474 Original Bulletin: https://www.suse.com/support/update/announcement/2019/suse-su-20184236-2.html - --------------------------BEGIN INCLUDED TEXT-------------------- SUSE Security Update: Security update for MozillaFirefox, mozil ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:4236-2 Rating: important References: #1097410 #1106873 #1119069 #1119105 Cross-References: CVE-2018-0495 CVE-2018-12384 CVE-2018-12404 CVE-2018-12405 CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494 CVE-2018-18498 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 ______________________________________________________________________________ la-nspr and mozilla-nss An update that fixes 9 vulnerabilities is now available. Description: This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues: Issues fixed in MozillaFirefox: o Update to Firefox ESR 60.4 (bsc#1119105) o CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 o CVE-2018-18492: Fixed a use-after-free with select element o CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia o CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs o CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images o CVE-2018-12405: Fixed a few memory safety bugs Issues fixed in mozilla-nss: o Update to NSS 3.40.1 (bsc#1119105) o CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069) o CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873) o CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410) o Fixed a decryption failure during FFDHE key exchange o Various security fixes in the ASN.1 code Issues fixed in mozilla-nspr: o Update mozilla-nspr to 4.20 (bsc#1119105) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: o SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2019-952=1 Package List: o SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): MozillaFirefox-60.4.0esr-109.55.1 MozillaFirefox-debuginfo-60.4.0esr-109.55.1 MozillaFirefox-debugsource-60.4.0esr-109.55.1 MozillaFirefox-devel-60.4.0esr-109.55.1 MozillaFirefox-translations-common-60.4.0esr-109.55.1 libfreebl3-3.40.1-58.18.1 libfreebl3-32bit-3.40.1-58.18.1 libfreebl3-debuginfo-3.40.1-58.18.1 libfreebl3-debuginfo-32bit-3.40.1-58.18.1 libsoftokn3-3.40.1-58.18.1 libsoftokn3-32bit-3.40.1-58.18.1 libsoftokn3-debuginfo-3.40.1-58.18.1 libsoftokn3-debuginfo-32bit-3.40.1-58.18.1 mozilla-nspr-32bit-4.20-19.6.1 mozilla-nspr-4.20-19.6.1 mozilla-nspr-debuginfo-32bit-4.20-19.6.1 mozilla-nspr-debuginfo-4.20-19.6.1 mozilla-nspr-debugsource-4.20-19.6.1 mozilla-nspr-devel-4.20-19.6.1 mozilla-nss-3.40.1-58.18.1 mozilla-nss-32bit-3.40.1-58.18.1 mozilla-nss-certs-3.40.1-58.18.1 mozilla-nss-certs-32bit-3.40.1-58.18.1 mozilla-nss-certs-debuginfo-3.40.1-58.18.1 mozilla-nss-certs-debuginfo-32bit-3.40.1-58.18.1 mozilla-nss-debuginfo-3.40.1-58.18.1 mozilla-nss-debuginfo-32bit-3.40.1-58.18.1 mozilla-nss-debugsource-3.40.1-58.18.1 mozilla-nss-devel-3.40.1-58.18.1 mozilla-nss-sysinit-3.40.1-58.18.1 mozilla-nss-sysinit-32bit-3.40.1-58.18.1 mozilla-nss-sysinit-debuginfo-3.40.1-58.18.1 mozilla-nss-sysinit-debuginfo-32bit-3.40.1-58.18.1 mozilla-nss-tools-3.40.1-58.18.1 mozilla-nss-tools-debuginfo-3.40.1-58.18.1 References: o https://www.suse.com/security/cve/CVE-2018-0495.html o https://www.suse.com/security/cve/CVE-2018-12384.html o https://www.suse.com/security/cve/CVE-2018-12404.html o https://www.suse.com/security/cve/CVE-2018-12405.html o https://www.suse.com/security/cve/CVE-2018-17466.html o https://www.suse.com/security/cve/CVE-2018-18492.html o https://www.suse.com/security/cve/CVE-2018-18493.html o https://www.suse.com/security/cve/CVE-2018-18494.html o https://www.suse.com/security/cve/CVE-2018-18498.html o https://bugzilla.suse.com/1097410 o https://bugzilla.suse.com/1106873 o https://bugzilla.suse.com/1119069 o https://bugzilla.suse.com/1119105 - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXLVN+2aOgq3Tt24GAQgoSRAAntUohLBgV4d2/A2SpJXoMHtIxX2AoEYG ZanXtK1JU4aeprsjXCc4IA2xJo9/pCj+BWZm225D+0EwQ0oPdxJYkUgdJXH/7VGK rP08ug/VPSJU6TUIXnGPLK7+M1hMJ++iLhN5VreOxchiy9fbOsWwQJJBYibjg0JR iLHvakpw0vIehuMGtj9EPtz9HUicFQrO51vuTlOwXMqmeilx5tcjiWnuMVEL8Sff zIYmbgs+Via+2eZG9A0JsMZAuk0P+/F4fiG/bEDHnHJhCS5croj41vblcs0HPuDi RwdWc79CnySl35ESxsxlFlvApmFmvL4mB9naYb61sqqv39Vge2963k+emF96TTkO gJiW45RO5BNxVGJGFOqPqaTgDe1bMoYE1+58gCUa/85Hts9yw5WmcU4gB8icT0Qv JBJt+dONOdqSF0PexvAYpuwLo0q+rTBJNkxZiB0IXVpPqiY4LcblhUBaIgqf/JI+ OJTvFRd4KhNLATHUjgz+Gr48EhtKrfFtFhqZdYTQmADZ1jHKRJk3uzHMsYz06v1x Xo65RfctoktdZzcNteMqMRlPaG8EhKdENvND4a32HjMjj6urmIWLYqTJeOLCvu6u 7Dz7GUu4DONJa9nIyXYxIRkHogPUvBWkpY9fe4BwJbGx+fY5g5E1Apxlff6YCz8K XWWAIc5ZM8w= =dR81 -----END PGP SIGNATURE-----