Security update for MozillaFirefox, mozilla-nss
Announcement ID: | SUSE-SU-2015:1476-1 |
---|---|
Rating: | important |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves 16 vulnerabilities can now be installed.
Description:
Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical and non critical security vulnerabilities.
- Firefox was updated to 38.2.1 ESR (bsc#943608)
- MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing canvas element during restyling
-
MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass through data URLs
-
Firefox was updated to 38.2.0 ESR (bsc#940806)
- MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262) Same origin violation and local file stealing via PDF reader
- MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130, bmo#1161719, bmo#1177501, bmo#1181204, bmo#1184068, bmo#1188590, bmo#1146213, bmo#1178890, bmo#1182711) Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)
- MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with malformed MP3 file
- MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of non-configurable JavaScript object properties
- MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107, bmo#1170344, bmo#1186718) Overflow issues in libstagefright
- MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared memory in JavaScript
- MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf when scaling bitmap images
- MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148) Buffer overflows on Libvpx when decoding WebM video
- MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 (bmo#1176270, bmo#1182723, bmo#1171603) Vulnerabilities found through code inspection
- MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in XMLHttpRequest with shared workers
Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox 38ESR uses.
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Desktop 12
zypper in -t patch SUSE-SLE-DESKTOP-12-2015-472=1
-
SUSE Linux Enterprise Software Development Kit 12
zypper in -t patch SUSE-SLE-SDK-12-2015-472=1
-
SUSE Linux Enterprise Server 12
zypper in -t patch SUSE-SLE-SERVER-12-2015-472=1
-
SUSE Linux Enterprise Server for SAP Applications 12
zypper in -t patch SUSE-SLE-SERVER-12-2015-472=1
Package List:
-
SUSE Linux Enterprise Desktop 12 (x86_64)
- libsoftokn3-debuginfo-3.19.2.0-26.2
- libsoftokn3-32bit-3.19.2.0-26.2
- mozilla-nss-certs-debuginfo-3.19.2.0-26.2
- libsoftokn3-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-tools-3.19.2.0-26.2
- libfreebl3-debuginfo-3.19.2.0-26.2
- mozilla-nss-certs-32bit-3.19.2.0-26.2
- mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-debuginfo-32bit-3.19.2.0-26.2
- MozillaFirefox-translations-38.2.1esr-45.1
- MozillaFirefox-debuginfo-38.2.1esr-45.1
- MozillaFirefox-38.2.1esr-45.1
- libfreebl3-3.19.2.0-26.2
- mozilla-nss-32bit-3.19.2.0-26.2
- mozilla-nss-debuginfo-3.19.2.0-26.2
- MozillaFirefox-branding-SLE-31.0-14.1
- mozilla-nss-certs-3.19.2.0-26.2
- mozilla-nss-debugsource-3.19.2.0-26.2
- MozillaFirefox-debugsource-38.2.1esr-45.1
- libfreebl3-debuginfo-32bit-3.19.2.0-26.2
- libfreebl3-32bit-3.19.2.0-26.2
- mozilla-nss-tools-debuginfo-3.19.2.0-26.2
- mozilla-nss-3.19.2.0-26.2
- libsoftokn3-3.19.2.0-26.2
-
SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64)
- MozillaFirefox-debugsource-38.2.1esr-45.1
- mozilla-nss-devel-3.19.2.0-26.2
- mozilla-nss-debuginfo-3.19.2.0-26.2
- MozillaFirefox-devel-38.2.1esr-45.1
- MozillaFirefox-debuginfo-38.2.1esr-45.1
- mozilla-nss-debugsource-3.19.2.0-26.2
-
SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64)
- MozillaFirefox-debugsource-38.2.1esr-45.1
- libsoftokn3-debuginfo-3.19.2.0-26.2
- libsoftokn3-3.19.2.0-26.2
- libfreebl3-debuginfo-3.19.2.0-26.2
- libsoftokn3-hmac-3.19.2.0-26.2
- mozilla-nss-certs-3.19.2.0-26.2
- mozilla-nss-debuginfo-3.19.2.0-26.2
- mozilla-nss-certs-debuginfo-3.19.2.0-26.2
- mozilla-nss-tools-debuginfo-3.19.2.0-26.2
- mozilla-nss-debugsource-3.19.2.0-26.2
- mozilla-nss-tools-3.19.2.0-26.2
- MozillaFirefox-translations-38.2.1esr-45.1
- MozillaFirefox-branding-SLE-31.0-14.1
- MozillaFirefox-debuginfo-38.2.1esr-45.1
- mozilla-nss-3.19.2.0-26.2
- MozillaFirefox-38.2.1esr-45.1
- libfreebl3-3.19.2.0-26.2
- libfreebl3-hmac-3.19.2.0-26.2
-
SUSE Linux Enterprise Server 12 (s390x x86_64)
- libfreebl3-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-32bit-3.19.2.0-26.2
- libsoftokn3-32bit-3.19.2.0-26.2
- libfreebl3-32bit-3.19.2.0-26.2
- mozilla-nss-certs-32bit-3.19.2.0-26.2
- libsoftokn3-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-debuginfo-32bit-3.19.2.0-26.2
- libfreebl3-hmac-32bit-3.19.2.0-26.2
- libsoftokn3-hmac-32bit-3.19.2.0-26.2
-
SUSE Linux Enterprise Server for SAP Applications 12 (x86_64)
- libsoftokn3-debuginfo-3.19.2.0-26.2
- libsoftokn3-32bit-3.19.2.0-26.2
- mozilla-nss-certs-debuginfo-3.19.2.0-26.2
- libsoftokn3-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-tools-3.19.2.0-26.2
- libfreebl3-hmac-32bit-3.19.2.0-26.2
- libfreebl3-debuginfo-3.19.2.0-26.2
- mozilla-nss-certs-32bit-3.19.2.0-26.2
- mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2
- mozilla-nss-debuginfo-32bit-3.19.2.0-26.2
- MozillaFirefox-translations-38.2.1esr-45.1
- MozillaFirefox-debuginfo-38.2.1esr-45.1
- MozillaFirefox-38.2.1esr-45.1
- libfreebl3-3.19.2.0-26.2
- libsoftokn3-hmac-32bit-3.19.2.0-26.2
- libfreebl3-hmac-3.19.2.0-26.2
- libsoftokn3-hmac-3.19.2.0-26.2
- mozilla-nss-32bit-3.19.2.0-26.2
- mozilla-nss-debuginfo-3.19.2.0-26.2
- MozillaFirefox-branding-SLE-31.0-14.1
- mozilla-nss-certs-3.19.2.0-26.2
- mozilla-nss-debugsource-3.19.2.0-26.2
- MozillaFirefox-debugsource-38.2.1esr-45.1
- libfreebl3-debuginfo-32bit-3.19.2.0-26.2
- libfreebl3-32bit-3.19.2.0-26.2
- mozilla-nss-tools-debuginfo-3.19.2.0-26.2
- mozilla-nss-3.19.2.0-26.2
- libsoftokn3-3.19.2.0-26.2
References:
- https://www.suse.com/security/cve/CVE-2015-4473.html
- https://www.suse.com/security/cve/CVE-2015-4474.html
- https://www.suse.com/security/cve/CVE-2015-4475.html
- https://www.suse.com/security/cve/CVE-2015-4478.html
- https://www.suse.com/security/cve/CVE-2015-4479.html
- https://www.suse.com/security/cve/CVE-2015-4484.html
- https://www.suse.com/security/cve/CVE-2015-4485.html
- https://www.suse.com/security/cve/CVE-2015-4486.html
- https://www.suse.com/security/cve/CVE-2015-4487.html
- https://www.suse.com/security/cve/CVE-2015-4488.html
- https://www.suse.com/security/cve/CVE-2015-4489.html
- https://www.suse.com/security/cve/CVE-2015-4491.html
- https://www.suse.com/security/cve/CVE-2015-4492.html
- https://www.suse.com/security/cve/CVE-2015-4495.html
- https://www.suse.com/security/cve/CVE-2015-4497.html
- https://www.suse.com/security/cve/CVE-2015-4498.html
- https://bugzilla.suse.com/show_bug.cgi?id=940806
- https://bugzilla.suse.com/show_bug.cgi?id=943557
- https://bugzilla.suse.com/show_bug.cgi?id=943558
- https://bugzilla.suse.com/show_bug.cgi?id=943608