-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.1303
        SUSE-SU-2018:4236-2 Security update for MozillaFirefox, mo
                        zilla-nspr and mozilla-nss
                               16 April 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           MozillaFirefox
                   mozilla-nspr
                   mozilla-nss
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
                   Access Confidential Data        -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-18498 CVE-2018-18494 CVE-2018-18493
                   CVE-2018-18492 CVE-2018-17466 CVE-2018-12405
                   CVE-2018-12404 CVE-2018-12384 CVE-2018-0495

Reference:         ESB-2019.0080.2
                   ESB-2019.0010
                   ESB-2018.3904
                   ESB-2018.3474

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2019/suse-su-20184236-2.html

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for MozillaFirefox, mozil

______________________________________________________________________________

Announcement ID:   SUSE-SU-2018:4236-2
Rating:            important
References:        #1097410 #1106873 #1119069 #1119105
Cross-References:  CVE-2018-0495 CVE-2018-12384 CVE-2018-12404 CVE-2018-12405
                   CVE-2018-17466 CVE-2018-18492 CVE-2018-18493 CVE-2018-18494
                   CVE-2018-18498
Affected Products:
                   SUSE Linux Enterprise Server for SAP 12-SP1
______________________________________________________________________________

la-nspr and
mozilla-nss

An update that fixes 9 vulnerabilities is now available.

Description:

This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the
following issues:
Issues fixed in MozillaFirefox:

  o Update to Firefox ESR 60.4 (bsc#1119105)
  o CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE
    library with TextureStorage11
  o CVE-2018-18492: Fixed a use-after-free with select element
  o CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia
  o CVE-2018-18494: Fixed a Same-origin policy violation using location
    attribute and performance.getEntries to steal cross-origin URLs
  o CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for
    images
  o CVE-2018-12405: Fixed a few memory safety bugs


Issues fixed in mozilla-nss:

  o Update to NSS 3.40.1 (bsc#1119105)
  o CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher
    attack (bsc#1119069)
  o CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an
    SSLv2-compatible ClientHello with a ServerHello that had an all-zero
    random. (bsc#1106873)
  o CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA
    signatures (bsc#1097410)
  o Fixed a decryption failure during FFDHE key exchange
  o Various security fixes in the ASN.1 code


Issues fixed in mozilla-nspr:

  o Update mozilla-nspr to 4.20 (bsc#1119105)

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Server for SAP 12-SP1:
    zypper in -t patch SUSE-SLE-SAP-12-SP1-2019-952=1

Package List:

  o SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64):
       MozillaFirefox-60.4.0esr-109.55.1
       MozillaFirefox-debuginfo-60.4.0esr-109.55.1
       MozillaFirefox-debugsource-60.4.0esr-109.55.1
       MozillaFirefox-devel-60.4.0esr-109.55.1
       MozillaFirefox-translations-common-60.4.0esr-109.55.1
       libfreebl3-3.40.1-58.18.1
       libfreebl3-32bit-3.40.1-58.18.1
       libfreebl3-debuginfo-3.40.1-58.18.1
       libfreebl3-debuginfo-32bit-3.40.1-58.18.1
       libsoftokn3-3.40.1-58.18.1
       libsoftokn3-32bit-3.40.1-58.18.1
       libsoftokn3-debuginfo-3.40.1-58.18.1
       libsoftokn3-debuginfo-32bit-3.40.1-58.18.1
       mozilla-nspr-32bit-4.20-19.6.1
       mozilla-nspr-4.20-19.6.1
       mozilla-nspr-debuginfo-32bit-4.20-19.6.1
       mozilla-nspr-debuginfo-4.20-19.6.1
       mozilla-nspr-debugsource-4.20-19.6.1
       mozilla-nspr-devel-4.20-19.6.1
       mozilla-nss-3.40.1-58.18.1
       mozilla-nss-32bit-3.40.1-58.18.1
       mozilla-nss-certs-3.40.1-58.18.1
       mozilla-nss-certs-32bit-3.40.1-58.18.1
       mozilla-nss-certs-debuginfo-3.40.1-58.18.1
       mozilla-nss-certs-debuginfo-32bit-3.40.1-58.18.1
       mozilla-nss-debuginfo-3.40.1-58.18.1
       mozilla-nss-debuginfo-32bit-3.40.1-58.18.1
       mozilla-nss-debugsource-3.40.1-58.18.1
       mozilla-nss-devel-3.40.1-58.18.1
       mozilla-nss-sysinit-3.40.1-58.18.1
       mozilla-nss-sysinit-32bit-3.40.1-58.18.1
       mozilla-nss-sysinit-debuginfo-3.40.1-58.18.1
       mozilla-nss-sysinit-debuginfo-32bit-3.40.1-58.18.1
       mozilla-nss-tools-3.40.1-58.18.1
       mozilla-nss-tools-debuginfo-3.40.1-58.18.1


References:

  o https://www.suse.com/security/cve/CVE-2018-0495.html
  o https://www.suse.com/security/cve/CVE-2018-12384.html
  o https://www.suse.com/security/cve/CVE-2018-12404.html
  o https://www.suse.com/security/cve/CVE-2018-12405.html
  o https://www.suse.com/security/cve/CVE-2018-17466.html
  o https://www.suse.com/security/cve/CVE-2018-18492.html
  o https://www.suse.com/security/cve/CVE-2018-18493.html
  o https://www.suse.com/security/cve/CVE-2018-18494.html
  o https://www.suse.com/security/cve/CVE-2018-18498.html
  o https://bugzilla.suse.com/1097410
  o https://bugzilla.suse.com/1106873
  o https://bugzilla.suse.com/1119069
  o https://bugzilla.suse.com/1119105

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXLVN+2aOgq3Tt24GAQgoSRAAntUohLBgV4d2/A2SpJXoMHtIxX2AoEYG
ZanXtK1JU4aeprsjXCc4IA2xJo9/pCj+BWZm225D+0EwQ0oPdxJYkUgdJXH/7VGK
rP08ug/VPSJU6TUIXnGPLK7+M1hMJ++iLhN5VreOxchiy9fbOsWwQJJBYibjg0JR
iLHvakpw0vIehuMGtj9EPtz9HUicFQrO51vuTlOwXMqmeilx5tcjiWnuMVEL8Sff
zIYmbgs+Via+2eZG9A0JsMZAuk0P+/F4fiG/bEDHnHJhCS5croj41vblcs0HPuDi
RwdWc79CnySl35ESxsxlFlvApmFmvL4mB9naYb61sqqv39Vge2963k+emF96TTkO
gJiW45RO5BNxVGJGFOqPqaTgDe1bMoYE1+58gCUa/85Hts9yw5WmcU4gB8icT0Qv
JBJt+dONOdqSF0PexvAYpuwLo0q+rTBJNkxZiB0IXVpPqiY4LcblhUBaIgqf/JI+
OJTvFRd4KhNLATHUjgz+Gr48EhtKrfFtFhqZdYTQmADZ1jHKRJk3uzHMsYz06v1x
Xo65RfctoktdZzcNteMqMRlPaG8EhKdENvND4a32HjMjj6urmIWLYqTJeOLCvu6u
7Dz7GUu4DONJa9nIyXYxIRkHogPUvBWkpY9fe4BwJbGx+fY5g5E1Apxlff6YCz8K
XWWAIc5ZM8w=
=dR81
-----END PGP SIGNATURE-----