SUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________

Announcement ID:    SUSE-SU-2017:2302-1
Rating:             important
References:         #1031485 #1052829 
Cross-References:   CVE-2017-7753 CVE-2017-7779 CVE-2017-7782
                    CVE-2017-7784 CVE-2017-7785 CVE-2017-7786
                    CVE-2017-7787 CVE-2017-7791 CVE-2017-7792
                    CVE-2017-7798 CVE-2017-7800 CVE-2017-7801
                    CVE-2017-7802 CVE-2017-7803 CVE-2017-7804
                    CVE-2017-7807
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11-SP4
                    SUSE Linux Enterprise Server 11-SP4
                    SUSE Linux Enterprise Server 11-SP3-LTSS
                    SUSE Linux Enterprise Point of Sale 11-SP3
                    SUSE Linux Enterprise Debuginfo 11-SP4
                    SUSE Linux Enterprise Debuginfo 11-SP3
______________________________________________________________________________

   An update that fixes 16 vulnerabilities is now available.

Description:



   Mozilla Firefox was updated to the ESR 52.3 release (bsc#1052829)

   Following security issues were fixed:

   * MFSA 2017-19/CVE-2017-7807: Domain hijacking through AppCache fallback
   * MFSA 2017-19/CVE-2017-7791: Spoofing following page navigation with
     data: protocol and modal alerts
   * MFSA 2017-19/CVE-2017-7792: Buffer overflow viewing certificates with an
     extremely long OID
   * MFSA 2017-19/CVE-2017-7782: WindowsDllDetourPatcher allocates memory
     without DEP protections
   * MFSA 2017-19/CVE-2017-7787: Same-origin policy bypass with iframes
     through page reloads
   * MFSA 2017-19/CVE-2017-7786: Buffer overflow while painting
     non-displayable SVG
   * MFSA 2017-19/CVE-2017-7785: Buffer overflow manipulating ARIA attributes
     in DOM
   * MFSA 2017-19/CVE-2017-7784: Use-after-free with image observers
   * MFSA 2017-19/CVE-2017-7753: Out-of-bounds read with cached style data
     and pseudo-elements
   * MFSA 2017-19/CVE-2017-7798: XUL injection in the style editor in devtools
   * MFSA 2017-19/CVE-2017-7804: Memory protection bypass through
     WindowsDllDetourPatcher
   * MFSA 2017-19/CVE-2017-7779: Memory safety bugs fixed in Firefox 55 and
     Firefox ESR 52.3
   * MFSA 2017-19/CVE-2017-7800: Use-after-free in WebSockets during
     disconnection
   * MFSA 2017-19/CVE-2017-7801: Use-after-free with marquee during window
     resizing
   * MFSA 2017-19/CVE-2017-7802: Use-after-free resizing image elements
   * MFSA 2017-19/CVE-2017-7803: CSP containing 'sandbox' improperly
 applied

   This update also fixes:

   -  fixed firefox hangs after a while in FUTEX_WAIT_PRIVATE if cgroups
      enabled and running on cpu >=1 (bsc#1031485)
   -  The Itanium ia64 build was fixed.


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11-SP4:

      zypper in -t patch sdksp4-MozillaFirefox-13254=1

   - SUSE Linux Enterprise Server 11-SP4:

      zypper in -t patch slessp4-MozillaFirefox-13254=1

   - SUSE Linux Enterprise Server 11-SP3-LTSS:

      zypper in -t patch slessp3-MozillaFirefox-13254=1

   - SUSE Linux Enterprise Point of Sale 11-SP3:

      zypper in -t patch sleposp3-MozillaFirefox-13254=1

   - SUSE Linux Enterprise Debuginfo 11-SP4:

      zypper in -t patch dbgsp4-MozillaFirefox-13254=1

   - SUSE Linux Enterprise Debuginfo 11-SP3:

      zypper in -t patch dbgsp3-MozillaFirefox-13254=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64
 s390x x86_64):

      MozillaFirefox-devel-52.3.0esr-72.9.1

   - SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      MozillaFirefox-52.3.0esr-72.9.1
      MozillaFirefox-branding-SLED-52-24.5.1
      MozillaFirefox-translations-52.3.0esr-72.9.1

   - SUSE Linux Enterprise Server 11-SP3-LTSS (i586 s390x x86_64):

      MozillaFirefox-52.3.0esr-72.9.1
      MozillaFirefox-branding-SLED-52-24.5.1
      MozillaFirefox-translations-52.3.0esr-72.9.1

   - SUSE Linux Enterprise Point of Sale 11-SP3 (i586):

      MozillaFirefox-52.3.0esr-72.9.1
      MozillaFirefox-branding-SLED-52-24.5.1
      MozillaFirefox-translations-52.3.0esr-72.9.1

   - SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

      MozillaFirefox-debuginfo-52.3.0esr-72.9.1

   - SUSE Linux Enterprise Debuginfo 11-SP3 (i586 s390x x86_64):

      MozillaFirefox-debuginfo-52.3.0esr-72.9.1


References:

   https://www.suse.com/security/cve/CVE-2017-7753.html
   https://www.suse.com/security/cve/CVE-2017-7779.html
   https://www.suse.com/security/cve/CVE-2017-7782.html
   https://www.suse.com/security/cve/CVE-2017-7784.html
   https://www.suse.com/security/cve/CVE-2017-7785.html
   https://www.suse.com/security/cve/CVE-2017-7786.html
   https://www.suse.com/security/cve/CVE-2017-7787.html
   https://www.suse.com/security/cve/CVE-2017-7791.html
   https://www.suse.com/security/cve/CVE-2017-7792.html
   https://www.suse.com/security/cve/CVE-2017-7798.html
   https://www.suse.com/security/cve/CVE-2017-7800.html
   https://www.suse.com/security/cve/CVE-2017-7801.html
   https://www.suse.com/security/cve/CVE-2017-7802.html
   https://www.suse.com/security/cve/CVE-2017-7803.html
   https://www.suse.com/security/cve/CVE-2017-7804.html
   https://www.suse.com/security/cve/CVE-2017-7807.html
   https://bugzilla.suse.com/1031485
   https://bugzilla.suse.com/1052829

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org