Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Mozilla Firefox
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Mozilla Firefox
ID: openSUSE-SU-2016:0733-1
Distribution: SUSE
Plattformen: openSUSE 13.1
Datum: So, 13. März 2016, 12:42
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1960
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2796
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1959
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1966
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1972
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1973
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1974
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1976
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1968
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2793
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1977
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1975
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1979
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1955
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1954
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1971
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1970
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2794
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2800
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1961
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2801
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1965
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2797
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2799
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1950
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2798
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1962
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1963
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2795
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1957
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1956
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2790
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2792
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1964
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1967
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1952
Applikationen: Mozilla Firefox

Originalnachricht

   openSUSE Security Update: Security update for Firefox
______________________________________________________________________________

Announcement ID: openSUSE-SU-2016:0733-1
Rating: important
References: #969894
Cross-References: CVE-2016-1950 CVE-2016-1952 CVE-2016-1953
CVE-2016-1954 CVE-2016-1955 CVE-2016-1956
CVE-2016-1957 CVE-2016-1958 CVE-2016-1959
CVE-2016-1960 CVE-2016-1961 CVE-2016-1962
CVE-2016-1963 CVE-2016-1964 CVE-2016-1965
CVE-2016-1966 CVE-2016-1967 CVE-2016-1968
CVE-2016-1970 CVE-2016-1971 CVE-2016-1972
CVE-2016-1973 CVE-2016-1974 CVE-2016-1975
CVE-2016-1976 CVE-2016-1977 CVE-2016-1979
CVE-2016-2790 CVE-2016-2791 CVE-2016-2792
CVE-2016-2793 CVE-2016-2794 CVE-2016-2795
CVE-2016-2796 CVE-2016-2797 CVE-2016-2798
CVE-2016-2799 CVE-2016-2800 CVE-2016-2801
CVE-2016-2802
Affected Products:
openSUSE 13.1
______________________________________________________________________________

An update that fixes 40 vulnerabilities is now available.

Description:

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the
following issues:

MozillaFirefox was updated to Firefox 45.0 (boo#969894)
* requires NSPR 4.12 / NSS 3.21.1
* Instant browser tab sharing through Hello
* Synced Tabs button in button bar
* Tabs synced via Firefox Accounts from other devices are now shown in
dropdown area of Awesome Bar when searching
* Introduce a new preference (network.dns.blockDotOnion) to allow
blocking .onion at the DNS level
* Tab Groups (Panorama) feature removed
* MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety
hazards
* MFSA 2016-17/CVE-2016-1954 (bmo#1243178) Local file overwriting and
potential privilege escalation through CSP reports
* MFSA 2016-18/CVE-2016-1955 (bmo#1208946) CSP reports fail to strip
location information for embedded iframe pages
* MFSA 2016-19/CVE-2016-1956 (bmo#1199923) Linux video memory DOS with
Intel drivers
* MFSA 2016-20/CVE-2016-1957 (bmo#1227052) Memory leak in
libstagefright when deleting an array during MP4 processing
* MFSA 2016-21/CVE-2016-1958 (bmo#1228754) Displayed page address can be
overridden
* MFSA 2016-22/CVE-2016-1959 (bmo#1234949) Service Worker Manager
out-of-bounds read in Service Worker Manager
* MFSA 2016-23/CVE-2016-1960/ZDI-CAN-3545 (bmo#1246014) Use-after-free
in HTML5 string parser
* MFSA 2016-24/CVE-2016-1961/ZDI-CAN-3574 (bmo#1249377) Use-after-free
in SetBody
* MFSA 2016-25/CVE-2016-1962 (bmo#1240760) Use-after-free when using
multiple WebRTC data channels
* MFSA 2016-26/CVE-2016-1963 (bmo#1238440) Memory corruption when
modifying a file being read by FileReader
* MFSA 2016-27/CVE-2016-1964 (bmo#1243335) Use-after-free during XML
transformations
* MFSA 2016-28/CVE-2016-1965 (bmo#1245264) Addressbar spoofing though
history navigation and Location protocol property
* MFSA 2016-29/CVE-2016-1967 (bmo#1246956) Same-origin policy violation
using perfomance.getEntries and history navigation with session
restore
* MFSA 2016-30/CVE-2016-1968 (bmo#1246742) Buffer overflow in Brotli
decompression
* MFSA 2016-31/CVE-2016-1966 (bmo#1246054) Memory corruption with
malicious NPAPI plugin
* MFSA 2016-32/CVE-2016-1970/CVE-2016-1971/CVE-2016-1975/
CVE-2016-1976/CVE-2016-1972 WebRTC and LibVPX vulnerabilities found
through code inspection
* MFSA 2016-33/CVE-2016-1973 (bmo#1219339) Use-after-free in
GetStaticInstance in WebRTC
* MFSA 2016-34/CVE-2016-1974 (bmo#1228103) Out-of-bounds read in HTML
parser following a failed allocation
* MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1
decoding in NSS (fixed by requiring 3.21.1)
* MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during
processing of DER encoded keys in NSS (fixed by requiring 3.21.1)
* MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/
CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/
CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/
CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the
Graphite 2 library

mozilla-nspr was updated to version 4.12
* added a PR_GetEnvSecure function, which attempts to detect if the
program is being executed with elevated privileges, and returns NULL
if detected. It is recommended to use this function in general
purpose library code.
* fixed a memory allocation bug related to the PR_*printf functions
* exported API PR_DuplicateEnvironment, which had already been added in
NSPR 4.10.9
* added support for FreeBSD aarch64
* several minor correctness and compatibility fixes

mozilla-nss was updated to NSS 3.21.1 (bmo#969894)
* required for Firefox 45.0
* MFSA 2016-35/CVE-2016-1950 (bmo#1245528) Buffer overflow during ASN.1
decoding in NSS (fixed by requiring 3.21.1)
* MFSA 2016-36/CVE-2016-1979 (bmo#1185033) Use-after-free during
processing of DER encoded keys in NSS (fixed by requiring 3.21.1)


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE 13.1:

zypper in -t patch 2016-334=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE 13.1 (i586 x86_64):

MozillaFirefox-45.0-109.1
MozillaFirefox-branding-upstream-45.0-109.1
MozillaFirefox-buildsymbols-45.0-109.1
MozillaFirefox-debuginfo-45.0-109.1
MozillaFirefox-debugsource-45.0-109.1
MozillaFirefox-devel-45.0-109.1
MozillaFirefox-translations-common-45.0-109.1
MozillaFirefox-translations-other-45.0-109.1
libfreebl3-3.21.1-74.1
libfreebl3-debuginfo-3.21.1-74.1
libsoftokn3-3.21.1-74.1
libsoftokn3-debuginfo-3.21.1-74.1
mozilla-nspr-4.12-34.1
mozilla-nspr-debuginfo-4.12-34.1
mozilla-nspr-debugsource-4.12-34.1
mozilla-nspr-devel-4.12-34.1
mozilla-nss-3.21.1-74.1
mozilla-nss-certs-3.21.1-74.1
mozilla-nss-certs-debuginfo-3.21.1-74.1
mozilla-nss-debuginfo-3.21.1-74.1
mozilla-nss-debugsource-3.21.1-74.1
mozilla-nss-devel-3.21.1-74.1
mozilla-nss-sysinit-3.21.1-74.1
mozilla-nss-sysinit-debuginfo-3.21.1-74.1
mozilla-nss-tools-3.21.1-74.1
mozilla-nss-tools-debuginfo-3.21.1-74.1

- openSUSE 13.1 (x86_64):

libfreebl3-32bit-3.21.1-74.1
libfreebl3-debuginfo-32bit-3.21.1-74.1
libsoftokn3-32bit-3.21.1-74.1
libsoftokn3-debuginfo-32bit-3.21.1-74.1
mozilla-nspr-32bit-4.12-34.1
mozilla-nspr-debuginfo-32bit-4.12-34.1
mozilla-nss-32bit-3.21.1-74.1
mozilla-nss-certs-32bit-3.21.1-74.1
mozilla-nss-certs-debuginfo-32bit-3.21.1-74.1
mozilla-nss-debuginfo-32bit-3.21.1-74.1
mozilla-nss-sysinit-32bit-3.21.1-74.1
mozilla-nss-sysinit-debuginfo-32bit-3.21.1-74.1


References:

https://www.suse.com/security/cve/CVE-2016-1950.html
https://www.suse.com/security/cve/CVE-2016-1952.html
https://www.suse.com/security/cve/CVE-2016-1953.html
https://www.suse.com/security/cve/CVE-2016-1954.html
https://www.suse.com/security/cve/CVE-2016-1955.html
https://www.suse.com/security/cve/CVE-2016-1956.html
https://www.suse.com/security/cve/CVE-2016-1957.html
https://www.suse.com/security/cve/CVE-2016-1958.html
https://www.suse.com/security/cve/CVE-2016-1959.html
https://www.suse.com/security/cve/CVE-2016-1960.html
https://www.suse.com/security/cve/CVE-2016-1961.html
https://www.suse.com/security/cve/CVE-2016-1962.html
https://www.suse.com/security/cve/CVE-2016-1963.html
https://www.suse.com/security/cve/CVE-2016-1964.html
https://www.suse.com/security/cve/CVE-2016-1965.html
https://www.suse.com/security/cve/CVE-2016-1966.html
https://www.suse.com/security/cve/CVE-2016-1967.html
https://www.suse.com/security/cve/CVE-2016-1968.html
https://www.suse.com/security/cve/CVE-2016-1970.html
https://www.suse.com/security/cve/CVE-2016-1971.html
https://www.suse.com/security/cve/CVE-2016-1972.html
https://www.suse.com/security/cve/CVE-2016-1973.html
https://www.suse.com/security/cve/CVE-2016-1974.html
https://www.suse.com/security/cve/CVE-2016-1975.html
https://www.suse.com/security/cve/CVE-2016-1976.html
https://www.suse.com/security/cve/CVE-2016-1977.html
https://www.suse.com/security/cve/CVE-2016-1979.html
https://www.suse.com/security/cve/CVE-2016-2790.html
https://www.suse.com/security/cve/CVE-2016-2791.html
https://www.suse.com/security/cve/CVE-2016-2792.html
https://www.suse.com/security/cve/CVE-2016-2793.html
https://www.suse.com/security/cve/CVE-2016-2794.html
https://www.suse.com/security/cve/CVE-2016-2795.html
https://www.suse.com/security/cve/CVE-2016-2796.html
https://www.suse.com/security/cve/CVE-2016-2797.html
https://www.suse.com/security/cve/CVE-2016-2798.html
https://www.suse.com/security/cve/CVE-2016-2799.html
https://www.suse.com/security/cve/CVE-2016-2800.html
https://www.suse.com/security/cve/CVE-2016-2801.html
https://www.suse.com/security/cve/CVE-2016-2802.html
https://bugzilla.suse.com/969894

--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung