This update for MozillaThunderbird to version 68.1.1 fixes the following issues :

  - CVE-2019-11709: Fixed several memory safety bugs.
    (bsc#1140868)

  - CVE-2019-11710: Fixed several memory safety bugs.
    (bsc#1140868)

  - CVE-2019-11711: Fixed a script injection within domain     through inner window reuse. (bsc#1140868)

  - CVE-2019-11712: Fixed an insufficient validation of     cross-origin POST requests within NPAPI plugins.
    (bsc#1140868)

  - CVE-2019-11713: Fixed a use-after-free with HTTP/2     cached stream. (bsc#1140868)

  - CVE-2019-11714: Fixed a crash in NeckoChild.
    (bsc#1140868)

  - CVE-2019-11715: Fixed an HTML parsing error that can     contribute to content XSS. (bsc#1140868)

  - CVE-2019-11716: Fixed an enumeration issue in     globalThis. (bsc#1140868)

  - CVE-2019-11717: Fixed an improper escaping of the caret     character in origins. (bsc#1140868)

  - CVE-2019-11719: Fixed an out-of-bounds read when     importing curve25519 private key. (bsc#1140868)

  - CVE-2019-11720: Fixed a character encoding XSS     vulnerability. (bsc#1140868)

  - CVE-2019-11721: Fixed domain spoofing through unicode     latin 'kra' character. (bsc#1140868)

  - CVE-2019-11723: Fixed a cookie leakage during add-on     fetching across private browsing boundaries.
    (bsc#1140868)

  - CVE-2019-11724: Fixed a permissions issue with the     retired site input.mozilla.org. (bsc#1140868)

  - CVE-2019-11725: Fixed a SafeBrowsing bypass through     WebSockets. (bsc#1140868)

  - CVE-2019-11727: Fixed an insufficient validation for     PKCS#1 v1.5 signatures being used with TLS 1.3.
    (bsc#1140868)

  - CVE-2019-11728: Fixed port scanning through Alt-Svc     header. (bsc#1140868)

  - CVE-2019-11729: Fixed a segmentation fault due to empty     or malformed p256-ECDH public keys. (bsc#1140868)

  - CVE-2019-11730: Fixed an insufficient enforcement of the     same-origin policy that treats all files in a directory     as having the same-origin. (bsc#1140868)

  - CVE-2019-11739: Fixed a Covert Content Attack on S/MIME     encryption using a crafted multipart/alternative     message. (bsc#1150939)

  - CVE-2019-11740: Fixed several memory safety bugs.
    (bsc#1149299)

  - CVE-2019-11742: Fixed a same-origin policy violation     with SVG filters and canvas that enabled theft of     cross-origin images. (bsc#1149303)

  - CVE-2019-11743: Fixed a cross-origin access issue.
    (bsc#1149298)

  - CVE-2019-11744: Fixed a XSS involving breaking out of     title and textarea elements using innerHTML.
    (bsc#1149304)

  - CVE-2019-11746: Fixed a use-after-free while     manipulating video. (bsc#1149297)

  - CVE-2019-11752: Fixed a use-after-free while extracting     a key value in IndexedDB. (bsc#1149296)

  - CVE-2019-11755: Fixed an insufficient validation of     S/MIME messages that allowed the author to be spoofed.
    (bsc#1152375)

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2663 advisory.

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and     portability.

    This update upgrades Firefox to version 68.1.0 ESR.

    Security Fix(es):

    * Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)

    * Mozilla: Memory safety bugs fixed in Firefox 69 and Firefox ESR 68.1 (CVE-2019-11735)

    * Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

    * Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images     (CVE-2019-11742)

    * Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

    * Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

    * Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

    * Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

    * Mozilla: Persistence of WebRTC permissions in a third party context (CVE-2019-11748)

    * Mozilla: Camera information available without prompting using getUserMedia (CVE-2019-11749)

    * Mozilla: Type confusion in Spidermonkey (CVE-2019-11750)

    * Mozilla: Content security policy bypass through hash-based sources in directives (CVE-2019-11738)

    * Mozilla: 'Forget about this site' removes sites from pre-loaded HSTS list (CVE-2019-11747)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - Mozilla: Sandbox escape through Firefox Sync     (CVE-2019-9812)

  - Mozilla: Memory safety bugs fixed in Firefox 69, Firefox     ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

  - Mozilla: Same-origin policy violation with SVG filters     and canvas to steal cross-origin images (CVE-2019-11742)

  - Mozilla: XSS by breaking out of title and textarea     elements using innerHTML (CVE-2019-11744)

  - Mozilla: Use-after-free while manipulating video     (CVE-2019-11746)

  - Mozilla: Use-after-free while extracting a key value in     IndexedDB (CVE-2019-11752)

  - firefox: stored passwords in 'Saved Logins' can be     copied without master password entry (CVE-2019-11733)

  - Mozilla: Cross-origin access to unload event attributes     (CVE-2019-11743)

This update for MozillaFirefox to ESR 60.9 fixes the following issues :

Security issues fixed :

CVE-2019-11742: Fixed a same-origin policy violation involving SVG filters and canvas to steal cross-origin images. (bsc#1149303)

CVE-2019-11746: Fixed a use-after-free while manipulating video.
(bsc#1149297)

CVE-2019-11744: Fixed an XSS caused by breaking out of title and textarea elements using innerHTML. (bsc#1149304)

CVE-2019-11753: Fixed a privilege escalation with Mozilla Maintenance Service in custom Firefox installation location. (bsc#1149295)

CVE-2019-11752: Fixed a use-after-free while extracting a key value in IndexedDB. (bsc#1149296)

CVE-2019-11743: Fixed a timing side-channel attack on cross-origin information, utilizing unload event attributes. (bsc#1149298)

CVE-2019-11740: Fixed several memory safety bugs. (bsc#1149299)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14173-1 advisory.

  - Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR     68, and Firefox 60.8. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects     Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
    (CVE-2019-11740)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached     image content. The resulting same-origin policy violation could allow for data theft. This vulnerability     affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1.
    (CVE-2019-11742)

  - Navigation events were not fully adhering to the W3C's Navigation-Timing Level 2 draft specification in     some instances for the unload event, which restricts access to detailed timing attributes to only be same-     origin. This resulted in potential cross-origin information exposure of history through timing side-     channel attacks. This vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox     ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11743)

  - Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without     treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and     subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site     does not filter user input as strictly for these elements as it does for other elements. This     vulnerability affects Firefox < 69, Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and     Firefox ESR < 68.1. (CVE-2019-11744)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11746)

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. This vulnerability affects Firefox < 69,     Thunderbird < 68.1, Thunderbird < 60.9, Firefox ESR < 60.9, and Firefox ESR < 68.1. (CVE-2019-11752)

  - The Firefox installer allows Firefox to be installed to a custom user writable location, leaving it     unprotected from manipulation by unprivileged users or malware. If the Mozilla Maintenance Service is     manipulated to update this unprotected location and the updated maintenance service in the unprotected     location has been altered, the altered maintenance service can run with elevated privileges during the     update process due to a lack of integrity checks. This allows for privilege escalation if the executable     has been replaced locally. *Note: This attack requires local system access and only affects Windows.
    Other operating systems are not affected.*. This vulnerability affects Firefox < 69, Firefox ESR < 60.9,     and Firefox ESR < 68.1. (CVE-2019-11753)

  - Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape     that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox     Sync account. Preference settings that disable the sandbox are then synchronized to the local machine and     the compromised browser would restart without the sandbox if a crash is triggered. This vulnerability     affects Firefox ESR < 60.9, Firefox ESR < 68.1, and Firefox < 69. (CVE-2019-9812)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
129663	openSUSE Security Update : MozillaThunderbird (openSUSE-2019-2249)	Nessus	SuSE Local Security Checks	10/7/2019	4/19/2024	critical
128517	RHEL 8 : firefox (RHSA-2019:2663)	Nessus	Red Hat Local Security Checks	9/5/2019	11/6/2024	critical
128861	Scientific Linux Security Update : firefox on SL7.x x86_64 (20190911)	Nessus	Scientific Linux Local Security Checks	9/16/2019	4/25/2024	critical
129286	SUSE SLED12 / SLES12 Security Update : MozillaFirefox (SUSE-SU-2019:2436-1)	Nessus	SuSE Local Security Checks	9/24/2019	4/23/2024	critical
150554	SUSE SLES11 Security Update : MozillaFirefox, firefox-glib2, firefox-gtk3 (SUSE-SU-2019:14173-1)	Nessus	SuSE Local Security Checks	6/10/2021	12/26/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical