SUSE-SU-2016:3105-1
- Source
- https://www.suse.com/support/update/announcement/2016/suse-su-20163105-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:3105-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2016:3105-1
- Related
- Published
- 2016-12-13T08:18:24Z
- Modified
- 2016-12-13T08:18:24Z
- Summary
- Security update for MozillaFirefox, mozilla-nss
- Details
-
This update for MozillaFirefox, mozilla-nss fixes security issues and bugs.
The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bsc#1009026):
- CVE-2016-9079: Use-after-free in SVG Animation (bsc#1012964 MFSA 2016-92)
- CVE-2016-5297: Incorrect argument length checking in Javascript (bsc#1010401)
- CVE-2016-9066: Integer overflow leading to a buffer overflow in nsScriptLoadHandler (bsc#1010404)
- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterizeedges1 (bsc#1010395)
- CVE-2016-9064: Addons update must verify IDs match between current and new versions (bsc#1010402)
- CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5 (bsc#1010427)
- CVE-2016-5291: Same-origin policy violation using local HTML file and saved shortcut file (bsc#1010410)
The following vulnerabilities were fixed in mozilla-nss 3.21.3:
- CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler (bsc#1010422)
- CVE-2016-5285: Missing NULL check in PK11SignWithSymKey / ssl3ComputeRecordMACConstantTime causes server crash (bsc#1010517)
The following bugs were fixed:
- Firefox would fail to go into fullscreen mode with some window managers (bsc#992549)
- font warning messages would flood console, now using fontconfig configuration from firefox-fontconfig instead of the system one (bsc#1000751)
- References
-
- https://www.suse.com/support/update/announcement/2016/suse-su-20163105-1/
- https://bugzilla.suse.com/1000751
- https://bugzilla.suse.com/1009026
- https://bugzilla.suse.com/1010395
- https://bugzilla.suse.com/1010401
- https://bugzilla.suse.com/1010402
- https://bugzilla.suse.com/1010404
- https://bugzilla.suse.com/1010410
- https://bugzilla.suse.com/1010422
- https://bugzilla.suse.com/1010427
- https://bugzilla.suse.com/1010517
- https://bugzilla.suse.com/1012964
- https://bugzilla.suse.com/992549
- https://www.suse.com/security/cve/CVE-2016-5285
- https://www.suse.com/security/cve/CVE-2016-5290
- https://www.suse.com/security/cve/CVE-2016-5291
- https://www.suse.com/security/cve/CVE-2016-5296
- https://www.suse.com/security/cve/CVE-2016-5297
- https://www.suse.com/security/cve/CVE-2016-9064
- https://www.suse.com/security/cve/CVE-2016-9066
- https://www.suse.com/security/cve/CVE-2016-9074
- https://www.suse.com/security/cve/CVE-2016-9079
Affected packages
SUSE:Linux Enterprise Server 11 SP2-LTSS / MozillaFirefox
Package
- Name
- MozillaFirefox
- Purl
- purl:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed45.5.1esr-63.1
Ecosystem specific
{
"binaries": [
{
"MozillaFirefox": "45.5.1esr-63.1",
"mozilla-nss-32bit": "3.21.3-30.1",
"MozillaFirefox-translations": "45.5.1esr-63.1",
"mozilla-nss-devel": "3.21.3-30.1",
"mozilla-nss-tools": "3.21.3-30.1",
"libfreebl3-32bit": "3.21.3-30.1",
"libfreebl3": "3.21.3-30.1",
"mozilla-nss": "3.21.3-30.1"
}
]
}
SUSE:Linux Enterprise Server 11 SP2-LTSS / mozilla-nss
Package
- Name
- mozilla-nss
- Purl
- purl:rpm/suse/mozilla-nss&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP2-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed3.21.3-30.1
Ecosystem specific
{
"binaries": [
{
"MozillaFirefox": "45.5.1esr-63.1",
"mozilla-nss-32bit": "3.21.3-30.1",
"MozillaFirefox-translations": "45.5.1esr-63.1",
"mozilla-nss-devel": "3.21.3-30.1",
"mozilla-nss-tools": "3.21.3-30.1",
"libfreebl3-32bit": "3.21.3-30.1",
"libfreebl3": "3.21.3-30.1",
"mozilla-nss": "3.21.3-30.1"
}
]
}