Security update for MozillaFirefox, rust-cbindgen SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:14826-1 Final 1 1 2021-10-18T08:43:46Z current 2021-10-18T08:43:46Z 2021-10-18T08:43:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox, rust-cbindgen This update for MozillaFirefox, rust-cbindgen fixes the following issues: MozillaFirefox was updated to Extended Support Release 91.2.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2021-45 (bsc#1191332) * CVE-2021-38496: Use-after-free in MessageTask * CVE-2021-38497: Validation message could have been overlaid on another origin * CVE-2021-38498: Use-after-free of nsLanguageAtomService object * CVE-2021-32810: Data race in crossbeam-deque * CVE-2021-38500: Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15, and Firefox ESR 91.2 * CVE-2021-38501: Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2 - Fixed crash in FIPS mode (bsc#1190710) Firefox Extended Support Release 91.1.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2021-40 (bsc#1190269, bsc#1190274) * CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer * CVE-2021-38495: Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1 Firefox 91.0.1esr ESR * Fixed: Fixed an issue causing buttons on the tab bar to be resized when loading certain websites (bug 1704404) (bmo#1704404) * Fixed: Fixed an issue which caused tabs from private windows to be visible in non-private windows when viewing switch-to- tab results in the address bar panel (bug 1720369) (bmo#1720369) * Fixed: Various stability fixes * Fixed: Security fix MFSA 2021-37 (bsc#1189547) * CVE-2021-29991 (bmo#1724896) Header Splitting possible with HTTP/3 Responses Firefox Extended Support Release 91.0 ESR * New: Some of the highlights of the new Extended Support Release are: - A number of user interface changes. For more information, see the Firefox 89 release notes. - Firefox now supports logging into Microsoft, work, and school accounts using Windows single sign-on. Learn more - On Windows, updates can now be applied in the background while Firefox is not running. - Firefox for Windows now offers a new page about:third-party to help identify compatibility issues caused by third-party applications - Version 2 of Firefox's SmartBlock feature further improves private browsing. Third party Facebook scripts are blocked to prevent you from being tracked, but are now automatically loaded 'just in time' if you decide to 'Log in with Facebook' on any website. - Enhanced the privacy of the Firefox Browser's Private Browsing mode with Total Cookie Protection, which confines cookies to the site where they were created, preventing companis from using cookies to track your browsing across sites. This feature was originally launched in Firefox's ETP Strict mode. - PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. - You'll encounter less website breakage in Private Browsing and Strict Enhanced Tracking Protection with SmartBlock, which provides stand-in scripts so that websites load properly. - Improved Print functionality with a cleaner design and better integration with your computer's printer settings. - Firefox now protects you from supercookies, a type of tracker that can stay hidden in your browser and track you online, even after you clear cookies. By isolating supercookies, Firefox prevents them from tracking your web browsing from one site to the next. - Firefox now remembers your preferred location for saved bookmarks, displays the bookmarks toolbar by default on new tabs, and gives you easy access to all of your bookmarks via a toolbar folder. - Native support for macOS devices built with Apple Silicon CPUs brings dramatic performance improvements over the non- native build that was shipped in Firefox 83: Firefox launches over 2.5 times faster and web apps are now twice as responsive (per the SpeedoMeter 2.0 test). If you are on a new Apple device, follow these steps to upgrade to the latest Firefox. - Pinch zooming will now be supported for our users with Windows touchscreen devices and touchpads on Mac devices. Firefox users may now use pinch to zoom on touch-capable devices to zoom in and out of webpages. - We’ve improved functionality and design for a number of Firefox search features: * Selecting a search engine at the bottom of the search panel now enters search mode for that engine, allowing you to see suggestions (if available) for your search terms. The old behavior (immediately performing a search) is available with a shift-click. * When Firefox autocompletes the URL of one of your search engines, you can now search with that engine directly in the address bar by selecting the shortcut in the address bar results. * We’ve added buttons at the bottom of the search panel to allow you to search your bookmarks, open tabs, and history. - Firefox supports AcroForm, which will allow you to fill in, print, and save supported PDF forms and the PDF viewer also has a new fresh look. - For our users in the US and Canada, Firefox can now save, manage, and auto-fill credit card information for you, making shopping on Firefox ever more convenient. - In addition to our default, dark and light themes, with this release, Firefox introduces the Alpenglow theme: a colorful appearance for buttons, menus, and windows. You can update your Firefox themes under settings or preferences. * Changed: Firefox no longer supports Adobe Flash. There is no setting available to re-enable Flash support. * Enterprise: Various bug fixes and new policies have been implemented in the latest version of Firefox. See more details in the Firefox for Enterprise 91 Release Notes. MFSA 2021-33 (bsc#1188891) * CVE-2021-29986: Race condition when resolving DNS names could have led to memory corruption * CVE-2021-29981: Live range splitting could have led to conflicting assignments in the JIT * CVE-2021-29988: Memory corruption as a result of incorrect style treatment * CVE-2021-29983: Firefox for Android could get stuck in fullscreen mode * CVE-2021-29984: Incorrect instruction reordering during JIT optimization * CVE-2021-29980: Uninitialized memory in a canvas object could have led to memory corruption * CVE-2021-29987: Users could have been tricked into accepting unwanted permissions on Linux * CVE-2021-29985: Use-after-free media channels * CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and type confusion * CVE-2021-29989: Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13 * CVE-2021-29990: Memory safety bugs fixed in Firefox 91 rust-cbindgen was updated to 0.19.0. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-MozillaFirefox-91esr-14826 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ Link for SUSE-SU-2021:14826-1 https://lists.suse.com/pipermail/sle-security-updates/2021-October/009604.html E-Mail link for SUSE-SU-2021:14826-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188891 SUSE Bug 1188891 https://bugzilla.suse.com/1189547 SUSE Bug 1189547 https://bugzilla.suse.com/1190269 SUSE Bug 1190269 https://bugzilla.suse.com/1190274 SUSE Bug 1190274 https://bugzilla.suse.com/1190710 SUSE Bug 1190710 https://bugzilla.suse.com/1191332 SUSE Bug 1191332 https://www.suse.com/security/cve/CVE-2021-29980/ SUSE CVE CVE-2021-29980 page https://www.suse.com/security/cve/CVE-2021-29981/ SUSE CVE CVE-2021-29981 page https://www.suse.com/security/cve/CVE-2021-29982/ SUSE CVE CVE-2021-29982 page https://www.suse.com/security/cve/CVE-2021-29983/ SUSE CVE CVE-2021-29983 page https://www.suse.com/security/cve/CVE-2021-29984/ SUSE CVE CVE-2021-29984 page https://www.suse.com/security/cve/CVE-2021-29985/ SUSE CVE CVE-2021-29985 page https://www.suse.com/security/cve/CVE-2021-29986/ SUSE CVE CVE-2021-29986 page https://www.suse.com/security/cve/CVE-2021-29987/ SUSE CVE CVE-2021-29987 page https://www.suse.com/security/cve/CVE-2021-29988/ SUSE CVE CVE-2021-29988 page https://www.suse.com/security/cve/CVE-2021-29989/ SUSE CVE CVE-2021-29989 page https://www.suse.com/security/cve/CVE-2021-29990/ SUSE CVE CVE-2021-29990 page https://www.suse.com/security/cve/CVE-2021-29991/ SUSE CVE CVE-2021-29991 page https://www.suse.com/security/cve/CVE-2021-32810/ SUSE CVE CVE-2021-32810 page https://www.suse.com/security/cve/CVE-2021-38492/ SUSE CVE CVE-2021-38492 page https://www.suse.com/security/cve/CVE-2021-38495/ SUSE CVE CVE-2021-38495 page https://www.suse.com/security/cve/CVE-2021-38496/ SUSE CVE CVE-2021-38496 page https://www.suse.com/security/cve/CVE-2021-38497/ SUSE CVE CVE-2021-38497 page https://www.suse.com/security/cve/CVE-2021-38498/ SUSE CVE CVE-2021-38498 page https://www.suse.com/security/cve/CVE-2021-38500/ SUSE CVE CVE-2021-38500 page https://www.suse.com/security/cve/CVE-2021-38501/ SUSE CVE CVE-2021-38501 page SUSE Linux Enterprise Server 11 SP4-LTSS MozillaFirefox-91.2.0-78.143.1 MozillaFirefox-branding-SLED-91-21.18.1 MozillaFirefox-translations-common-91.2.0-78.143.1 MozillaFirefox-translations-other-91.2.0-78.143.1 MozillaFirefox-91.2.0-78.143.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS MozillaFirefox-branding-SLED-91-21.18.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS MozillaFirefox-translations-common-91.2.0-78.143.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS MozillaFirefox-translations-other-91.2.0-78.143.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29980 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29980.html CVE-2021-29980 https://bugzilla.suse.com/1188891 SUSE Bug 1188891 An issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29981 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29981.html CVE-2021-29981 https://bugzilla.suse.com/1189631 SUSE Bug 1189631 Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29982 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29982.html CVE-2021-29982 https://bugzilla.suse.com/1189630 SUSE Bug 1189630 Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit. *Note: This issue only affected Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91. CVE-2021-29983 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29983.html CVE-2021-29983 Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29984 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29984.html CVE-2021-29984 https://bugzilla.suse.com/1188891 SUSE Bug 1188891 A use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29985 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29985.html CVE-2021-29985 https://bugzilla.suse.com/1188891 SUSE Bug 1188891 A suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash. *Note: This issue only affected Linux operating systems. Other operating systems are unaffected.* This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29986 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29986.html CVE-2021-29986 https://bugzilla.suse.com/1188891 SUSE Bug 1188891 After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still record a click in the default location, making it possible to trick a user into accepting a permission they did not want to. *This bug only affects Firefox on Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 91 and Thunderbird < 91. CVE-2021-29987 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29987.html CVE-2021-29987 https://bugzilla.suse.com/1189629 SUSE Bug 1189629 Firefox incorrectly treated an inline list-item element as a block element, resulting in an out of bounds read or memory corruption, and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.13, Thunderbird < 91, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29988 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29988.html CVE-2021-29988 https://bugzilla.suse.com/1188891 SUSE Bug 1188891 Mozilla developers reported memory safety bugs present in Firefox 90 and Firefox ESR 78.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.13, Firefox ESR < 78.13, and Firefox < 91. CVE-2021-29989 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29989.html CVE-2021-29989 https://bugzilla.suse.com/1188891 SUSE Bug 1188891 Mozilla developers and community members reported memory safety bugs present in Firefox 90. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 91. CVE-2021-29990 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29990.html CVE-2021-29990 https://bugzilla.suse.com/1189628 SUSE Bug 1189628 Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox < 91.0.1 and Thunderbird < 91.0.1. CVE-2021-29991 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-29991.html CVE-2021-29991 https://bugzilla.suse.com/1189547 SUSE Bug 1189547 crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. CVE-2021-32810 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-32810.html CVE-2021-32810 https://bugzilla.suse.com/1191332 SUSE Bug 1191332 When delegating navigations to the operating system, Firefox would accept the `mk` scheme which might allow attackers to launch pages and execute scripts in Internet Explorer in unprivileged mode. *This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92, Thunderbird < 91.1, Thunderbird < 78.14, Firefox ESR < 78.14, and Firefox ESR < 91.1. CVE-2021-38492 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38492.html CVE-2021-38492 https://bugzilla.suse.com/1190269 SUSE Bug 1190269 Mozilla developers reported memory safety bugs present in Thunderbird 78.13.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.1 and Firefox ESR < 91.1. CVE-2021-38495 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38495.html CVE-2021-38495 https://bugzilla.suse.com/1190269 SUSE Bug 1190269 During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. CVE-2021-38496 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38496.html CVE-2021-38496 https://bugzilla.suse.com/1191332 SUSE Bug 1191332 Through use of reportValidity() and window.open(), a plain-text validation message could have been overlaid on another origin, leading to possible user confusion and spoofing attacks. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38497 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38497.html CVE-2021-38497 https://bugzilla.suse.com/1191332 SUSE Bug 1191332 During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38498 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38498.html CVE-2021-38498 https://bugzilla.suse.com/1191332 SUSE Bug 1191332 Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.15, Thunderbird < 91.2, Firefox ESR < 91.2, Firefox ESR < 78.15, and Firefox < 93. CVE-2021-38500 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38500.html CVE-2021-38500 https://bugzilla.suse.com/1191332 SUSE Bug 1191332 Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 93, Thunderbird < 91.2, and Firefox ESR < 91.2. CVE-2021-38501 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-branding-SLED-91-21.18.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-common-91.2.0-78.143.1 SUSE Linux Enterprise Server 11 SP4-LTSS:MozillaFirefox-translations-other-91.2.0-78.143.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114826-1/ https://www.suse.com/security/cve/CVE-2021-38501.html CVE-2021-38501 https://bugzilla.suse.com/1191332 SUSE Bug 1191332