Security update for MozillaFirefox SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1629-1 Final 1 1 2019-06-21T09:16:57Z current 2019-06-21T09:16:57Z 2019-06-21T09:16:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox This update for MozillaFirefox to version 60.7.1 fixes the following issues: Security issue fixed: - CVE-2019-11707: Fixed a type confusion vulnerability in Arrary.pop (bsc#1138614) Other issues addressed: - Added the new Mozilla's GPG key expiring on 2021-05-29 to the mozilla.keyring file - Fixed broken language plugins (bsc#1137792) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-LI-BYOS-Production-2019-1629,Image SLES15-SAP-Azure-VLI-BYOS-Production-2019-1629,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2019-1629,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2019-1629,SUSE-2019-1629,SUSE-SLE-Module-Desktop-Applications-15-2019-1629,SUSE-SLE-Module-Desktop-Applications-15-SP1-2019-1629,SUSE-SLE-Module-Development-Tools-OBS-15-2019-1629,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-1629 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191629-1/ Link for SUSE-SU-2019:1629-1 https://lists.suse.com/pipermail/sle-security-updates/2019-June/005600.html E-Mail link for SUSE-SU-2019:1629-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1137792 SUSE Bug 1137792 https://bugzilla.suse.com/1138614 SUSE Bug 1138614 https://www.suse.com/security/cve/CVE-2019-11707/ SUSE CVE CVE-2019-11707 page Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Module for Desktop Applications 15 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-60.7.1-3.45.1 MozillaFirefox-branding-upstream-60.7.1-3.45.1 MozillaFirefox-buildsymbols-60.7.1-3.45.1 MozillaFirefox-devel-60.7.1-3.45.1 MozillaFirefox-translations-common-60.7.1-3.45.1 MozillaFirefox-translations-other-60.7.1-3.45.1 MozillaFirefox-60.7.1-3.45.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production MozillaFirefox-60.7.1-3.45.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production MozillaFirefox-60.7.1-3.45.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production MozillaFirefox-60.7.1-3.45.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production MozillaFirefox-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 MozillaFirefox-devel-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 MozillaFirefox-translations-common-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 MozillaFirefox-translations-other-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 MozillaFirefox-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-devel-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-translations-common-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 MozillaFirefox-translations-other-60.7.1-3.45.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. CVE-2019-11707 Image SLES15-SAP-Azure-LI-BYOS-Production:MozillaFirefox-60.7.1-3.45.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-60.7.1-3.45.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:MozillaFirefox-60.7.1-3.45.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-devel-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-common-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:MozillaFirefox-translations-other-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-devel-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-common-60.7.1-3.45.1 SUSE Linux Enterprise Module for Desktop Applications 15:MozillaFirefox-translations-other-60.7.1-3.45.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191629-1/ https://www.suse.com/security/cve/CVE-2019-11707.html CVE-2019-11707 https://bugzilla.suse.com/1138614 SUSE Bug 1138614