File _patchinfo of Package patchinfo.8721

<patchinfo incident="8721">
  <issue id="1094767" tracker="bnc">Firefox error message "Gah. Your tab just crashed. We can help! Choose Restore This Tab to reload the page." when opening certain webpages</issue>
  <issue id="1109465" tracker="bnc">Latest Firefox update not released for s390x</issue>
  <issue id="1066489" tracker="bnc">VUL-1: CVE-2017-16541: MozillaFirefox: information disclosure through file:// URLs</issue>
  <issue id="1108771" tracker="bnc">current mozilla update breaks apache2-mod_nss openqa tests</issue>
  <issue tracker="bnc" id="1108986">FF update crashes on start</issue>
  <issue tracker="bnc" id="1049703">llvm built with unsupported BUILD_SHARED_LIBS</issue>
  <issue tracker="bnc" id="1061204">libfreeblpriv3-i586 contains illegal SSE instructions and crashes Firefox on AMD Athlon</issue>
  <issue tracker="bnc" id="1107343">VUL-0: MozillaFirefox: 62 / 60.2 ESR releases</issue>
  <issue tracker="bnc" id="1064786">llvm4 constraints require too many resources</issue>
  <issue tracker="bnc" id="1041894">NSPR 4.13.1 tracker bug</issue>
  <issue tracker="bnc" id="1021577">llvm 3.9.1 made some icons red</issue>
  <issue tracker="bnc" id="1026191">Add BPF into llvm target for PowerPC64 and AArch64</issue>
  <issue tracker="bnc" id="1092697">LLVM build fails on armv7l</issue>
  <issue tracker="bnc" id="1073210">Link Time Optimization doesn't work out of the box on 64 bit systems because of bfd-plugins path mixup</issue>
  <issue tracker="bnc" id="1012260">Clang++-3.8 symlink is missing</issue>
  <issue tracker="bnc" id="1041469">llvm4 spec issues</issue>
  <issue tracker="bnc" id="1091551">llvm build dependency required for Firefox 60 ESR</issue>
  <issue tracker="bnc" id="1096515">Mozilla NSS 3.36.4 required for Firefox 60.0.2</issue>
  <issue tracker="bnc" id="857131">The is no 32bit compatibility package for libclang</issue>
  <issue tracker="bnc" id="839074">A regression in mesa 9.2 or 9.1, some games and programs no longer start.</issue>
  <issue tracker="bnc" id="893359">clang fails to compile helloworld on ARM</issue>
  <issue tracker="bnc" id="703591">clang man page is actually a postscript file</issue>
  <issue tracker="bnc" id="1078436">llvm5 fails to build on ppc64le and s390x</issue>
  <issue tracker="bnc" id="1065464">Don't allow multiple OpenCL ICD packages to be installed simultaneously</issue>
  <issue tracker="bnc" id="1110506">VUL-0: CVE-2018-12386: MozillaFirefox: Type confusion in JavaScript</issue>
  <issue tracker="bnc" id="1110507">VUL-0: CVE-2018-12387: MozillaFirefox: Array.prototype.push stack pointer vulnerability</issue>
  <issue tracker="bnc" id="1109363">VUL-0: CVE-2018-12385: MozillaFirefox: Crash in TransportSecurityInfo due to cached data</issue>
  <issue tracker="bnc" id="1107343">VUL-0: MozillaFirefox: 62 / 60.2 ESR releases</issue>
  <issue tracker="cve" id="2017-16541"/>
  <issue tracker="cve" id="2018-12377"/>
  <issue tracker="cve" id="2018-12376"/>
  <issue tracker="cve" id="2018-12379"/>
  <issue tracker="cve" id="2018-12381"/>
  <issue tracker="cve" id="2018-12378"/>
  <issue tracker="cve" id="2018-12386"/>
  <issue tracker="cve" id="2018-12387"/>
  <issue tracker="cve" id="2018-12385"/>
  <issue tracker="cve" id="2018-12383"/>
  <issue tracker="fate" id="319582"/>
  <category>security</category>
  <rating>important</rating>
  <packager>pcerny</packager>
  <description>This update for MozillaFirefox to ESR 60.2.2 fixes several issues.

These general changes are part of the version 60 release.

- New browser engine with speed improvements
- Redesigned graphical user interface elements
- Unified address and search bar for new installations
- New tab page listing top visited, recently visited and recommended pages
- Support for configuration policies in enterprise deployments via JSON files
- Support for Web Authentication, allowing the use of USB tokens for
  authentication to web sites

The following changes affect compatibility:
    
- Now exclusively supports extensions built using the WebExtension API.
- Unsupported legacy extensions will no longer work in Firefox 60 ESR
- TLS certificates issued by Symantec before June 1st, 2016 are no longer trusted 
  The "security.pki.distrust_ca_policy" preference can be set to 0 to reinstate
  trust in those certificates

The following issues affect performance:

- new format for storing private keys, certificates and certificate trust
  If the user home or data directory is on a network file system, it is
  recommended that users set the following environment variable to avoid
  slowdowns: NSS_SDB_USE_CACHE=yes
  This setting is not recommended for local, fast file systems. 

These security issues were fixed:

- CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation (bsc#1107343).
- CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1107343).
- CVE-2018-12376: Various memory safety bugs (bsc#1107343).
- CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343).
- CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343).
- CVE-2018-12379: Out-of-bounds write with malicious MAR file (bsc#1107343).
- CVE-2018-12386: Type confusion in JavaScript allowed remote code execution (bsc#1110506)
- CVE-2018-12387: Array.prototype.push stack pointer vulnerability may enable exploits in the sandboxed content process (bsc#1110507)
- CVE-2018-12385: Crash in TransportSecurityInfo due to cached data  (bsc#1109363)
- CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords  (bsc#1107343)

This update for mozilla-nspr to version 4.19 fixes the follwing issues

- Added TCP Fast Open functionality
- A socket without PR_NSPR_IO_LAYER will no longer trigger
  an assertion when polling

This update for mozilla-nss to version 3.36.4 fixes the follwing issues

- Connecting to a server that was recently upgraded to TLS 1.3
  would result in a SSL_RX_MALFORMED_SERVER_HELLO error.
- Fix a rare bug with PKCS#12 files.
- Replaces existing vectorized ChaCha20 code with verified
  HACL* implementation.
- TLS 1.3 support has been updated to draft -23.
- Added formally verified implementations of non-vectorized Chacha20
  and non-vectorized Poly1305 64-bit.
- The following CA certificates were Removed:
  OU = Security Communication EV RootCA1
  CN = CA Disig Root R1
  CN = DST ACES CA X6
  Certum CA, O=Unizeto Sp. z o.o.
  StartCom Certification Authority
  StartCom Certification Authority G2
  TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3
  ACEDICOM Root
  Certinomis - Autorité Racine
  TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı
  PSCProcert
  CA 沃通根证书, O=WoSign CA Limited
  Certification Authority of WoSign
  Certification Authority of WoSign G2
  CA WoSign ECC Root
  Subject CN = VeriSign Class 3 Secure Server CA - G2
  O = Japanese Government, OU = ApplicationCA
  CN = WellsSecure Public Root Certificate Authority
  CN = TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H6
  CN = Microsec e-Szigno Root
* The following CA certificates were Removed:
  AddTrust Public CA Root
  AddTrust Qualified CA Root
  China Internet Network Information Center EV Certificates Root
  CNNIC ROOT
  ComSign Secured CA
  GeoTrust Global CA 2
  Secure Certificate Services
  Swisscom Root CA 1
  Swisscom Root EV CA 2
  Trusted Certificate Services
  UTN-USERFirst-Hardware
  UTN-USERFirst-Object
* The following CA certificates were Added
  CN = D-TRUST Root CA 3 2013
  CN = TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1
  GDCA TrustAUTH R5 ROOT
  SSL.com Root Certification Authority RSA
  SSL.com Root Certification Authority ECC
  SSL.com EV Root Certification Authority RSA R2
  SSL.com EV Root Certification Authority ECC
  TrustCor RootCert CA-1
  TrustCor RootCert CA-2
  TrustCor ECA-1
* The Websites (TLS/SSL) trust bit was turned off for the following
  CA certificates:
  CN = Chambers of Commerce Root
  CN = Global Chambersign Root
* TLS servers are able to handle a ClientHello statelessly, if the
  client supports TLS 1.3.  If the server sends a HelloRetryRequest,
  it is possible to discard the server socket, and make a new socket
  to handle any subsequent ClientHello. This better enables stateless
  server operation. (This feature is added in support of QUIC, but it
  also has utility for DTLS 1.3 servers.)

Due to the update of mozilla-nss apache2-mod_nss needs to be updated to 
change to the SQLite certificate database, which is now the default (bsc#1108771)
  </description>
  <summary>Security update for MozillaFirefox, MozillaFirefox-branding-SLE, llvm4, mozilla-nspr, mozilla-nss, apache2-mod_nss</summary>
</patchinfo>