Errata overview
Errata ID 51
Date 2018-05-16
Source package firefox-esr
Fixed in version 52.8.0esr-1~deb9u1
Description
This update addresses the following issues:
* CVE-2018-5125: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7
* CVE-2018-5127: Buffer overflow manipulating SVG animatedPathSegList
* CVE-2018-5129: Out-of-bounds write with malformed IPC messages
* CVE-2018-5130: Mismatched RTP payload type can trigger memory corruption
* CVE-2018-5131: Fetch API improperly returns cached copies of
  no-store/no-cache resources
* CVE-2018-5144: Integer overflow during Unicode conversion
* CVE-2018-5145: Memory safety bugs fixed in Firefox ESR 52.7
* CVE-2018-5146: Vorbis audio processing out of bounds write
* CVE-2018-5147: Out of bounds memory write in libtremor
* CVE-2018-5148: Use-after-free in compositor potentially allows code
  execution
* CVE-2018-5150: Memory safety bugs fixed in Firefox 60 and Firefox ESR 52.8
* CVE-2018-5154: Use-after-free with SVG animations and clip paths
* CVE-2018-5155: Use-after-free with SVG animations and text paths
* CVE-2018-5157: Same-origin bypass of PDF Viewer to view protected PDF files
* CVE-2018-5158: Malicious PDF can inject JavaScript into PDF Viewer
* CVE-2018-5159: Integer overflow and out-of-bounds write in Skia
* CVE-2018-5168: Lightweight themes can be installed without user interaction
* CVE-2018-5178: Buffer overflow during UTF-8 to Unicode string conversion
  through legacy extension
* CVE-2018-5183: Backport critical security fixes in Skia
Additional notes
CVE ID CVE-2018-5125
CVE-2018-5127
CVE-2018-5129
CVE-2018-5130
CVE-2018-5131
CVE-2018-5144
CVE-2018-5145
CVE-2018-5146
CVE-2018-5147
CVE-2018-5148
CVE-2018-5150
CVE-2018-5154
CVE-2018-5155
CVE-2018-5157
CVE-2018-5158
CVE-2018-5159
CVE-2018-5168
CVE-2018-5178
CVE-2018-5183
UCS Bug number #46686