Пакет firefox: Информация

- New release (61.0).
- Fixed:
  + CVE-2018-12359: Buffer overflow using computed size of canvas element
  + CVE-2018-12360: Use-after-free when using focus()
  + CVE-2018-12361: Integer overflow in SwizzleData
  + CVE-2018-12358: Same-origin bypass using service worker and redirection
  + CVE-2018-12362: Integer overflow in SSSE3 scaler
  + CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
  + CVE-2018-12363: Use-after-free when appending DOM nodes
  + CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
  + CVE-2018-12365: Compromised IPC child process can list local filenames
  + CVE-2018-12371: Integer overflow in Skia library during edge builder allocation
  + CVE-2018-12366: Invalid data handling during QCMS transformations
  + CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming
  + CVE-2018-12368: No warning when opening executable SettingContent-ms files
  + CVE-2018-12369: WebExtension security permission checks bypassed by embedded experiments
  + CVE-2018-12370: SameSite cookie protections bypassed when exiting Reader View
  + CVE-2018-5186: Memory safety bugs fixed in Firefox 61
  + CVE-2018-5187: Memory safety bugs fixed in Firefox 60 and Firefox ESR 60.1
  + CVE-2018-5188: Memory safety bugs fixed in Firefox 60, Firefox ESR 60.1, and Firefox ESR 52.9

- New release (60.0.2).
- Fixed:
  + CVE-2018-6126: Heap buffer overflow rasterizing paths in SVG with Skia

- New release (60.0.1).
- Fixed:
  + CVE-2018-5154: Use-after-free with SVG animations and clip paths
  + CVE-2018-5155: Use-after-free with SVG animations and text paths
  + CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
  + CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
  + CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
  + CVE-2018-5160: Uninitialized memory use by WebRTC encoder
  + CVE-2018-5152: WebExtensions information leak through webRequest API
  + CVE-2018-5153: Out-of-bounds read in mixed content websocket messages
  + CVE-2018-5163: Replacing cached data in JavaScript Start-up Bytecode Cache
  + CVE-2018-5164: CSP not applied to all multipart content sent with multipart/x-mixed-replace
  + CVE-2018-5166: WebExtension host permission bypass through filterReponseData
  + CVE-2018-5167: Improper linkification of chrome: and javascript: content in web console and JavaScript debugger
  + CVE-2018-5168: Lightweight themes can be installed without user interaction
  + CVE-2018-5169: Dragging and dropping link text onto home button can set home page to include chrome pages
  + CVE-2018-5172: Pasted script from clipboard can run in the Live Bookmarks page or PDF viewer
  + CVE-2018-5173: File name spoofing of Downloads panel with Unicode characters
  + CVE-2018-5174: Windows Defender SmartScreen UI runs with less secure behavior for downloaded files in Windows 10 April 2018 Update
  + CVE-2018-5175: Universal CSP bypass on sites using strict-dynamic in their policies
  + CVE-2018-5176: JSON Viewer script injection
  + CVE-2018-5177: Buffer overflow in XSLT during number formatting
  + CVE-2018-5165: Checkbox for enabling Flash protected mode is inverted in 32-bit Firefox
  + CVE-2018-5180: heap-use-after-free in mozilla::WebGLContext::DrawElementsInstanced
  + CVE-2018-5181: Local file can be displayed in noopener tab through drag and drop of hyperlink
  + CVE-2018-5182: Local file can be displayed from hyperlink dragged and dropped on addressbar
  + CVE-2018-5151: Memory safety bugs fixed in Firefox 60
  + CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8