FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mozilla -- multiple vulnerabilities

Affected packages
firefox < 60.0,1
waterfox < 56.1.0_18
linux-seamonkey < 2.49.4
seamonkey < 2.49.4
firefox-esr < 52.8.0,1
linux-firefox < 52.8.0,2
libxul < 52.8.0
linux-thunderbird < 52.8.0
thunderbird < 52.8.0

Details

VuXML ID 5aefc41e-d304-4ec8-8c82-824f84f08244
Discovery 2018-05-09
Entry 2018-05-09

Mozilla Foundation reports:

CVE-2018-5183: Backport critical security fixes in Skia

CVE-2018-5154: Use-after-free with SVG animations and clip paths

CVE-2018-5155: Use-after-free with SVG animations and text paths

CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files

CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer

CVE-2018-5159: Integer overflow and out-of-bounds write in Skia

CVE-2018-5160: Uninitialized memory use by WebRTC encoder

CVE-2018-5152: WebExtensions information leak through webRequest API

CVE-2018-5153: Out-of-bounds read in mixed content websocket messages

CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache

CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace

CVE-2018-5166: WebExtension host permission bypass through filterReponseData

CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger

CVE-2018-5168: Lightweight themes can be installed without user interaction

CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages

CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer

CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters

CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update

CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies

CVE-2018-5176: JSON Viewer script injection

CVE-2018-5177: Buffer overflow in XSLT during number formatting

CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox

CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion through legacy extension

CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced

CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink

CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar

CVE-2018-5151: Memory safety bugs fixed in Firefox 60

CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8

References

CVE Name CVE-2018-5150
CVE Name CVE-2018-5151
CVE Name CVE-2018-5152
CVE Name CVE-2018-5153
CVE Name CVE-2018-5154
CVE Name CVE-2018-5155
CVE Name CVE-2018-5157
CVE Name CVE-2018-5158
CVE Name CVE-2018-5159
CVE Name CVE-2018-5160
CVE Name CVE-2018-5163
CVE Name CVE-2018-5164
CVE Name CVE-2018-5165
CVE Name CVE-2018-5166
CVE Name CVE-2018-5167
CVE Name CVE-2018-5168
CVE Name CVE-2018-5169
CVE Name CVE-2018-5172
CVE Name CVE-2018-5173
CVE Name CVE-2018-5174
CVE Name CVE-2018-5175
CVE Name CVE-2018-5176
CVE Name CVE-2018-5177
CVE Name CVE-2018-5178
CVE Name CVE-2018-5180
CVE Name CVE-2018-5181
CVE Name CVE-2018-5182
CVE Name CVE-2018-5183
URL https://www.mozilla.org/security/advisories/mfsa2018-11/
URL https://www.mozilla.org/security/advisories/mfsa2018-12/