Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT Security Bulletin ASB-2018.0304 Firefox 64 security released 12 December 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Mozilla Firefox Operating System: Windows UNIX variants (UNIX, Linux, OSX) BSD variants Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Access Confidential Data -- Remote with User Interaction Unauthorised Access -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2018-18498 CVE-2018-18497 CVE-2018-18496 CVE-2018-18495 CVE-2018-18494 CVE-2018-18493 CVE-2018-18492 CVE-2018-17466 CVE-2018-12407 CVE-2018-12406 CVE-2018-12405 Member content until: Friday, January 11 2019 OVERVIEW Mozilla have released Firefox 64 with multiple security fixes. [1] IMPACT Mozilla advises that the following vulnerabilities have been addressed: "# CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module Reporter: Omair working with iDefense Labs Impact: high Description A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content, when working with the VertexBuffer11 module. This results in a potentially exploitable crash. # CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11 Reporter: Omair Impact: high Description A buffer overflow and out-of-bounds read can occur in TextureStorage11 within the ANGLE graphics library, used for WebGL content. This results in a potentially exploitable crash. # CVE-2018-18492: Use-after-free with select element Reporter: Nils Impact: high Description A use-after-free vulnerability can occur after deleting a selection element due to a weak reference to the select element in the options collection. This results in a potentially exploitable crash. # CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia Reporter: Atte Kettunen Impact: high Description A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. # CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs Reporter: James Lee of Kryptos Logic Impact: high Description A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries(). This is a same-origin policy violation and could allow for data theft. # CVE-2018-18495: WebExtension content scripts can be loaded in about: pages Reporter: Kestrel Impact: moderate Description WebExtension content scripts can be loaded into about: pages in some circumstances, in violation of the permissions granted to extensions. This could allow an extension to interfere with the loading and usage of these pages and use capabilities that were intended to be restricted from extensions. # CVE-2018-18496: Embedded feed preview page can be abused for clickjacking Reporter: Abdulrahman Alqabandi Impact: moderate Description When the RSS Feed preview about:feeds page is framed within another page, it can be used in concert with scripted content for a clickjacking attack that confuses users into downloading and executing an executable file from a temporary directory. Note: This issue only affects Windows operating systems. Other operating systems are not affected. # CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators Reporter: Rob Wu Impact: moderate Description Limitations on the URIs allowed to WebExtensions by the browser.windows.create API can be bypassed when a pipe in the URL field is used within the extension to load multiple pages as a single argument. This could allow a malicious WebExtension to opened privileged about: or file: locations. # CVE-2018-18498: Integer overflow when calculating buffer sizes for images Reporter: r [sic] Impact: low Description A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This can lead to an out-of-bounds write. # CVE-2018-12406: Memory safety bugs fixed in Firefox 64 Reporter: Mozilla developers and community Impact: critical Description Mozilla developers and community members Alex Gaynor, Andr? Bargull, Boris Zbarsky, Christian Holler, Jan de Mooij, Jason Kratzer, Jed Davis, Philipp, Ronald Crane, Natalia Csoregi, and Paul Theriault reported memory safety bugs present in Firefox 63. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. # CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4 Reporter: Mozilla developers and community Impact: critical Description Mozilla developers and community members Christian Holler, Diego Calleja, Andrew McCreight, Jon Coppeard, Natalia Csoregi, Nicolas B. Pierron, and Tyson Smith reported memory safety bugs present in Firefox 63 and Firefox ESR 60.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code." [1] MITIGATION Mozilla advises updating to Firefox version 64 to address these vulnerabilities. [1] REFERENCES [1] Mozilla Foundation Security Advisory 2018-29 https://www.mozilla.org/en-US/security/advisories/mfsa2018-29/ AusCERT has made every effort to ensure that the information contained in this document is accurate. However, the decision to use the information described is the responsibility of each user or organisation. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXBBNT2aOgq3Tt24GAQjKLA//R7z9xFSaXKf0c5TPy14NpZqXGtbtW3co yf3cqHuWYsf7TWxxVmnWuynSz/+c6DrDJB5OrlMXIMGbP/InEL1+KjVlZEwMyazX sbMr9Ote6adZfwrCcisuSlIAbPTyI9a1y/OsW2JPXOTVFFcEFATFi6k/50hVI9Vc N2GAGVZ+ihNgoUlEywoGGbl5r+PVuTFIH3pBDlSN+3Ej0RaTJvwaLQRUctcogF63 lcRcIOoPYY76JabzWTcGF2fH312oTG/cmueKAGfwxG3UD/9OUpJ6cQOqXA0eBPEm bMXesgpgMxHmyK9+uBU75XkCE9BdcGBHsrwxcs/NLB4qgOXbQS/AvtRYpiAF2ilN c0/xFr8Dqv1xiR4lMTOubbRmn+vR2vmIV/wqaJGoHxGzfMl1YWtFgq+nWtYx8LF0 1wU6FFnJw7jW4CCmtJza+OX5HIun3yebeVSye+HWTVSgN1AgY4JPJHGTFqjcOSX6 XUC7aUtZfWBItNpHsz00vgfW5HNVqmg/1kZJ53XE/6iPsxRLPr5KrGC2cDlZqxQe gGXRGziiO9Hjyz5BRvxEGRsHqlgLjXj7u8WBiDcTL5PZY9u8A9tk54olO1flgVZL EL/Y0Pqz2ImUju6yT/RQDqZ1IE7Om35zpggyf7KTVMKLTUgK8uYXl/UMuDaq8SbE UzaqmXKRUJI= =whmT -----END PGP SIGNATURE-----