SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2018:2890-1)

High Nessus Plugin ID 120110

Synopsis

The remote SUSE host is missing one or more security updates.

Description

This update for MozillaFirefox to ESR 60.2 fixes several issues.

These general changes are part of the version 60 release.

New browser engine with speed improvements

Redesigned graphical user interface elements

Unified address and search bar for new installations

New tab page listing top visited, recently visited and recommended pages

Support for configuration policies in enterprise deployments via JSON files

Support for Web Authentication, allowing the use of USB tokens for authentication to websites

The following changes affect compatibility: Now exclusively supports extensions built using the WebExtension API.

Unsupported legacy extensions will no longer work in Firefox 60 ESR

TLS certificates issued by Symantec before June 1st, 2016 are no longer trusted The 'security.pki.distrust_ca_policy' preference can be set to 0 to reinstate trust in those certificates

The following issues affect performance: new format for storing private keys, certificates and certificate trust If the user home or data directory is on a network file system, it is recommended that users set the following environment variable to avoid slowdowns:
NSS_SDB_USE_CACHE=yes This setting is not recommended for local, fast file systems.

These security issues were fixed: CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation (bsc#1107343).

CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1107343).

CVE-2018-12376: Various memory safety bugs (bsc#1107343).

CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343).

CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343).

CVE-2018-12379: Out-of-bounds write with malicious MAR file (bsc#1107343).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'.

Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Module for Desktop Applications 15:zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-2018-2053=1

See Also

https://bugzilla.suse.com/show_bug.cgi?id=1107343

https://www.suse.com/security/cve/CVE-2017-16541/

https://www.suse.com/security/cve/CVE-2018-12376/

https://www.suse.com/security/cve/CVE-2018-12377/

https://www.suse.com/security/cve/CVE-2018-12378/

https://www.suse.com/security/cve/CVE-2018-12379/

https://www.suse.com/security/cve/CVE-2018-12381/

http://www.nessus.org/u?c8fe4862

Plugin Details

Severity: High

ID: 120110

File Name: suse_SU-2018-2890-1.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2019/01/02

Updated: 2019/09/10

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

CVSS v3.0

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:MozillaFirefox, p-cpe:/a:novell:suse_linux:MozillaFirefox-branding-SLE, p-cpe:/a:novell:suse_linux:MozillaFirefox-debuginfo, p-cpe:/a:novell:suse_linux:MozillaFirefox-debugsource, p-cpe:/a:novell:suse_linux:MozillaFirefox-devel, p-cpe:/a:novell:suse_linux:MozillaFirefox-translations-common, p-cpe:/a:novell:suse_linux:MozillaFirefox-translations-other, cpe:/o:novell:suse_linux:15

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2018/09/27

Vulnerability Publication Date: 2017/11/04

Reference Information

CVE: CVE-2017-16541, CVE-2018-12376, CVE-2018-12377, CVE-2018-12378, CVE-2018-12379, CVE-2018-12381