AXSA:2019-3896:02

Release date: 
Tuesday, May 28, 2019 - 07:50
Subject: 
firefox-60.7.0-1.0.1.AXS4
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.7.0 ESR.

Security Fix(es):

* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)

* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)

* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)

* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)

* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)

* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)

* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)

* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)

* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)

* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)

* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)

* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)

* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2018-18511
Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox < 65.0.1.
CVE-2019-11691
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-11692
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-11693
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-11698
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-5798
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-7317
png_image_free in png.c in libpng 1.6.36 has a use-after-free because png_image_free_function is called under png_safe_execute.
CVE-2019-9797
Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox < 66.
CVE-2019-9800
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-9816
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-9817
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-9819
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2019-9820
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. firefox-60.7.0-1.0.1.AXS4.src.rpm
    MD5: dff809dae13a40cd0132f9826a2f4eb4
    SHA-256: bd1899a824bfa1bc29cf4fd721dede6d539f5c391ea2977ce0bb85ed5ad08a8e
    Size: 416.69 MB

Asianux Server 4 for x86
  1. firefox-60.7.0-1.0.1.AXS4.i686.rpm
    MD5: 6689a596c11766bd8b1e7ba107b539d5
    SHA-256: 40f0ec2aa4ab609598b854feedeccd6ce5c3b10aa497334f30863b13def73575
    Size: 115.01 MB

Asianux Server 4 for x86_64
  1. firefox-60.7.0-1.0.1.AXS4.x86_64.rpm
    MD5: 10b1eb6d6190a96d53fd69931deccb65
    SHA-256: 3e0039fcb0097f631119f242287cdd6d4a01c395ca1334dccd6f51f418347ebe
    Size: 115.24 MB
  2. firefox-60.7.0-1.0.1.AXS4.i686.rpm
    MD5: 6689a596c11766bd8b1e7ba107b539d5
    SHA-256: 40f0ec2aa4ab609598b854feedeccd6ce5c3b10aa497334f30863b13def73575
    Size: 115.01 MB
Copyright© 2007-2015 Asianux. All rights reserved.