Security update for MozillaFirefox SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:1593-1 Final 1 1 2019-06-23T12:00:53Z current 2019-06-23T12:00:53Z 2019-06-23T12:00:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox This update for MozillaFirefox fixes the following issues: Mozilla Firefox 60.7.1esr was released to address MFSA 2019-18 (boo#1138614) * CVE-2019-11707: Fixed a type confusion in Array.pop The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-1593 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00054.html E-Mail link for openSUSE-SU-2019:1593-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1138614 SUSE Bug 1138614 https://www.suse.com/security/cve/CVE-2019-11707/ SUSE CVE CVE-2019-11707 page openSUSE Leap 15.0 MozillaFirefox-60.7.2-lp150.3.59.1 MozillaFirefox-branding-upstream-60.7.2-lp150.3.59.1 MozillaFirefox-buildsymbols-60.7.2-lp150.3.59.1 MozillaFirefox-devel-60.7.2-lp150.3.59.1 MozillaFirefox-translations-common-60.7.2-lp150.3.59.1 MozillaFirefox-translations-other-60.7.2-lp150.3.59.1 MozillaFirefox-60.7.2-lp150.3.59.1 as a component of openSUSE Leap 15.0 MozillaFirefox-branding-upstream-60.7.2-lp150.3.59.1 as a component of openSUSE Leap 15.0 MozillaFirefox-buildsymbols-60.7.2-lp150.3.59.1 as a component of openSUSE Leap 15.0 MozillaFirefox-devel-60.7.2-lp150.3.59.1 as a component of openSUSE Leap 15.0 MozillaFirefox-translations-common-60.7.2-lp150.3.59.1 as a component of openSUSE Leap 15.0 MozillaFirefox-translations-other-60.7.2-lp150.3.59.1 as a component of openSUSE Leap 15.0 A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2. CVE-2019-11707 openSUSE Leap 15.0:MozillaFirefox-60.7.2-lp150.3.59.1 openSUSE Leap 15.0:MozillaFirefox-branding-upstream-60.7.2-lp150.3.59.1 openSUSE Leap 15.0:MozillaFirefox-buildsymbols-60.7.2-lp150.3.59.1 openSUSE Leap 15.0:MozillaFirefox-devel-60.7.2-lp150.3.59.1 openSUSE Leap 15.0:MozillaFirefox-translations-common-60.7.2-lp150.3.59.1 openSUSE Leap 15.0:MozillaFirefox-translations-other-60.7.2-lp150.3.59.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-06/msg00054.html https://www.suse.com/security/cve/CVE-2019-11707.html CVE-2019-11707 https://bugzilla.suse.com/1138614 SUSE Bug 1138614