Security update for seamonkey
This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr (boo#1098998). Security issues fixed with MFSA 2018-16 (boo#1098998): * CVE-2018-12359: Buffer overflow using computed size of canvas element * CVE-2018-12360: Use-after-free when using focus() * CVE-2018-12362: Integer overflow in SSSE3 scaler * CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture * CVE-2018-12363: Use-after-free when appending DOM nodes * CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins * CVE-2018-12365: Compromised IPC child process can list local filenames * CVE-2018-12366: Invalid data handling during QCMS transformations * CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Localizations finally included again (boo#1062195) Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with Update to Seamonkey 2.49.2 * Gecko 52.6esr (including security relevant fixes) (boo#1077291) * fix issue in Composer * With some themes, the menulist- and history-dropmarker didn't show * Scrollbars didn't show the buttons * WebRTC has been disabled by default. It needs an add-on to enable it per site * The active title bar was not visually emphasized Correct requires and provides handling (boo#1076907) This update was imported from the openSUSE:Leap:15.0:Update update project.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for seamonkey fixes the following issues: Mozilla Seamonkey was updated to 2.49.4: Now uses Gecko 52.9.1esr (boo#1098998). Security issues fixed with MFSA 2018-16 (boo#1098998): * CVE-2018-12359: Buffer overflow using computed size of canvas element * CVE-2018-12360: Use-after-free when using focus() * CVE-2018-12362: Integer overflow in SSSE3 scaler * CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture * CVE-2018-12363: Use-after-free when appending DOM nodes * CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins * CVE-2018-12365: Compromised IPC child process can list local filenames * CVE-2018-12366: Invalid data handling during QCMS transformations * CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9 Localizations finally included again (boo#1062195) Updated summary and description to more accurately reflect what SeaMonkey is, giving less prominence to the long- discontinued Mozilla Application Suite that many users may no longer be familiar with Update to Seamonkey 2.49.2 * Gecko 52.6esr (including security relevant fixes) (boo#1077291) * fix issue in Composer * With some themes, the menulist- and history-dropmarker didn't show * Scrollbars didn't show the buttons * WebRTC has been disabled by default. It needs an add-on to enable it per site * The active title bar was not visually emphasized Correct requires and provides handling (boo#1076907) This update was imported from the openSUSE:Leap:15.0:Update update project.
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1020631
- https://bugzilla.suse.com/1062195
- https://bugzilla.suse.com/1076907
- https://bugzilla.suse.com/1077291
- https://bugzilla.suse.com/1098998
- https://lists.opensuse.org/archives/list/[email protected]/thread/GLUOSK2EJUPHGOY64OTIF2JORV62RASV/#GLUOSK2EJUPHGOY64OTIF2JORV62RASV
- https://www.suse.com/security/cve/CVE-2018-12359
- https://www.suse.com/security/cve/CVE-2018-12360
- https://www.suse.com/security/cve/CVE-2018-12362
- https://www.suse.com/security/cve/CVE-2018-12363
- https://www.suse.com/security/cve/CVE-2018-12364
- https://www.suse.com/security/cve/CVE-2018-12365
- https://www.suse.com/security/cve/CVE-2018-12366
- https://www.suse.com/security/cve/CVE-2018-5156
- https://www.suse.com/security/cve/CVE-2018-5188