Security update for MozillaFirefox SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:2393-1 Final 1 1 2021-07-19T07:01:57Z current 2021-07-19T07:01:57Z 2021-07-19T07:01:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 78.12.0 ESR * Fixed: Various stability, functionality, and security fixes MFSA 2021-29 (bsc#1188275) * CVE-2021-29970 (bmo#1709976): Use-after-free in accessibility features of a document * CVE-2021-30547 (bmo#1715766): Out of bounds write in ANGLE * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910, bmo#1711576, bmo#1714391): Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2021-2393,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2021-2393,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2021-2393,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2021-2393,Image SLES15-SP4-SAP-Azure-LI-BYOS-2021-2393,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2021-2393,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2021-2393,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2021-2393,Image SLES15-SP5-SAP-Azure-LI-BYOS-2021-2393,Image SLES15-SP5-SAP-Azure-LI-BYOS-Production-2021-2393,Image SLES15-SP5-SAP-Azure-VLI-BYOS-2021-2393,Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production-2021-2393,SUSE-2021-2393,SUSE-SLE-Module-Desktop-Applications-15-SP2-2021-2393,SUSE-SLE-Module-Desktop-Applications-15-SP3-2021-2393 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20212393-1/ Link for SUSE-SU-2021:2393-1 https://lists.suse.com/pipermail/sle-updates/2021-July/019626.html E-Mail link for SUSE-SU-2021:2393-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188275 SUSE Bug 1188275 https://www.suse.com/security/cve/CVE-2021-29970/ SUSE CVE CVE-2021-29970 page https://www.suse.com/security/cve/CVE-2021-29976/ SUSE CVE CVE-2021-29976 page https://www.suse.com/security/cve/CVE-2021-30547/ SUSE CVE CVE-2021-30547 page Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Module for Desktop Applications 15 SP2 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 MozillaFirefox-78.12.0-8.46.1 MozillaFirefox-branding-upstream-78.12.0-8.46.1 MozillaFirefox-buildsymbols-78.12.0-8.46.1 MozillaFirefox-devel-78.12.0-8.46.1 MozillaFirefox-translations-common-78.12.0-8.46.1 MozillaFirefox-translations-other-78.12.0-8.46.1 MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS MozillaFirefox-78.12.0-8.46.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production MozillaFirefox-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 MozillaFirefox-devel-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 MozillaFirefox-translations-common-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 MozillaFirefox-translations-other-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP2 MozillaFirefox-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 MozillaFirefox-devel-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 MozillaFirefox-translations-common-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 MozillaFirefox-translations-other-78.12.0-8.46.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. CVE-2021-29970 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-devel-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-translations-common-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-translations-other-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-devel-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-translations-common-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-translations-other-78.12.0-8.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212393-1/ https://www.suse.com/security/cve/CVE-2021-29970.html CVE-2021-29970 https://bugzilla.suse.com/1188275 SUSE Bug 1188275 Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90. CVE-2021-29976 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-devel-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-translations-common-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-translations-other-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-devel-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-translations-common-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-translations-other-78.12.0-8.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212393-1/ https://www.suse.com/security/cve/CVE-2021-29976.html CVE-2021-29976 https://bugzilla.suse.com/1188275 SUSE Bug 1188275 Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. CVE-2021-30547 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:MozillaFirefox-78.12.0-8.46.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-devel-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-translations-common-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP2:MozillaFirefox-translations-other-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-devel-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-translations-common-78.12.0-8.46.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:MozillaFirefox-translations-other-78.12.0-8.46.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20212393-1/ https://www.suse.com/security/cve/CVE-2021-30547.html CVE-2021-30547 https://bugzilla.suse.com/1187141 SUSE Bug 1187141 https://bugzilla.suse.com/1188275 SUSE Bug 1188275