SUSE-SU-2017:2302-1

Dashboard / Vulnerabilities / SUSE-SU-2017:2302-1

SUSE-SU-2017:2302-1

Summary: Security update for MozillaFirefox

Details: Mozilla Firefox was updated to the ESR 52.3 release (bsc#1052829) Following security issues were fixed: * MFSA 2017-19/CVE-2017-7807: Domain hijacking through AppCache fallback * MFSA 2017-19/CVE-2017-7791: Spoofing following page navigation with data: protocol and modal alerts * MFSA 2017-19/CVE-2017-7792: Buffer overflow viewing certificates with an extremely long OID * MFSA 2017-19/CVE-2017-7782: WindowsDllDetourPatcher allocates memory without DEP protections * MFSA 2017-19/CVE-2017-7787: Same-origin policy bypass with iframes through page reloads * MFSA 2017-19/CVE-2017-7786: Buffer overflow while painting non-displayable SVG * MFSA 2017-19/CVE-2017-7785: Buffer overflow manipulating ARIA attributes in DOM * MFSA 2017-19/CVE-2017-7784: Use-after-free with image observers * MFSA 2017-19/CVE-2017-7753: Out-of-bounds read with cached style data and pseudo-elements * MFSA 2017-19/CVE-2017-7798: XUL injection in the style editor in devtools * MFSA 2017-19/CVE-2017-7804: Memory protection bypass through WindowsDllDetourPatcher * MFSA 2017-19/CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and Firefox ESR 52.3 * MFSA 2017-19/CVE-2017-7800: Use-after-free in WebSockets during disconnection * MFSA 2017-19/CVE-2017-7801: Use-after-free with marquee during window resizing * MFSA 2017-19/CVE-2017-7802: Use-after-free resizing image elements * MFSA 2017-19/CVE-2017-7803: CSP containing 'sandbox' improperly applied This update also fixes: - fixed firefox hangs after a while in FUTEX_WAIT_PRIVATE if cgroups enabled and running on cpu >=1 (bsc#1031485) - The Itanium ia64 build was fixed.

References: https://www.suse.com/support/update/announcement/2017/suse-su-20172302-1/, https://bugzilla.suse.com/1031485, https://bugzilla.suse.com/1052829, https://www.suse.com/security/cve/CVE-2017-7753, https://www.suse.com/security/cve/CVE-2017-7779, https://www.suse.com/security/cve/CVE-2017-7782, https://www.suse.com/security/cve/CVE-2017-7784, https://www.suse.com/security/cve/CVE-2017-7785, https://www.suse.com/security/cve/CVE-2017-7786, https://www.suse.com/security/cve/CVE-2017-7787, https://www.suse.com/security/cve/CVE-2017-7791, https://www.suse.com/security/cve/CVE-2017-7792, https://www.suse.com/security/cve/CVE-2017-7798, https://www.suse.com/security/cve/CVE-2017-7800, https://www.suse.com/security/cve/CVE-2017-7801, https://www.suse.com/security/cve/CVE-2017-7802, https://www.suse.com/security/cve/CVE-2017-7803, https://www.suse.com/security/cve/CVE-2017-7804, https://www.suse.com/security/cve/CVE-2017-7807