openSUSE Security Update: Security update for MozillaFirefox, MozillaThunderbird, mozilla-nspr
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:0677-1
Rating: important
References: #925368 #925392 #925393 #925394 #925395 #925396
#925397 #925398 #925399 #925400 #925401 #925402
#926166
Cross-References: CVE-2015-0799 CVE-2015-0801 CVE-2015-0802
CVE-2015-0803 CVE-2015-0804 CVE-2015-0805
CVE-2015-0806 CVE-2015-0807 CVE-2015-0808
CVE-2015-0811 CVE-2015-0812 CVE-2015-0813
CVE-2015-0814 CVE-2015-0815 CVE-2015-0816

Affected Products:
openSUSE 13.2
openSUSE 13.1
______________________________________________________________________________

An update that fixes 15 vulnerabilities is now available.

Description:

Mozilla Firefox and Thunderbird were updated to fix several important
vulnerabilities.

Mozilla Firefox was updated to 37.0.1. Mozilla Thunderbird was updated to
31.6.0. mozilla-nspr was updated to 4.10.8 as a dependency.

The following vulnerabilities were fixed in Mozilla Firefox:

* Miscellaneous memory safety hazards (MFSA
2015-30/CVE-2015-0814/CVE-2015-0815 boo#925392)
* Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA
2015-31/CVE-2015-0813 bmo#1106596 boo#925393)
* Add-on lightweight theme installation approval bypassed through MITM
attack (MFSA 2015-32/CVE-2015-0812 bmo#1128126 boo#925394)
* resource:// documents can load privileged pages (MFSA
2015-33/CVE-2015-0816 bmo#1144991 boo#925395)
* Out of bounds read in QCMS library (MFSA-2015-34/CVE-2015-0811
bmo#1132468 boo#925396)
* Incorrect memory management for simple-type arrays in WebRTC
(MFSA-2015-36/CVE-2015-0808 bmo#1109552 boo#925397)
* CORS requests should not follow 30x redirections after preflight
(MFSA-2015-37/CVE-2015-0807 bmo#1111834 boo#925398)
* Memory corruption crashes in Off Main Thread Compositing
(MFSA-2015-38/CVE-2015-0805/CVE-2015-0806 bmo#1135511 bmo#1099437
boo#925399)
* Use-after-free due to type confusion flaws
(MFSA-2015-39/CVE-2015-0803/CVE-2015-0804 (mo#1134560 boo#925400)
* Same-origin bypass through anchor navigation (MFSA-2015-40/CVE-2015-0801
bmo#1146339 boo#925401)
* Windows can retain access to privileged content on navigation to
unprivileged pages (MFSA-2015-42/CVE-2015-0802 bmo#1124898 boo#925402)

The following vulnerability was fixed in functionality that was not
released as an update to openSUSE:

* Certificate verification could be bypassed through the HTTP/2 Alt-Svc
header (MFSA 2015-44/CVE-2015-0799 bmo#1148328 bnc#926166)

The functionality added in 37.0 and thus removed in 37.0.1 was:

* Opportunistically encrypt HTTP traffic where the server supports HTTP/2
AltSvc

The following functionality was added or updated in Mozilla Firefox:

* Heartbeat user rating system
* Yandex set as default search provider for the Turkish locale
* Bing search now uses HTTPS for secure searching
* Improved protection against site impersonation via OneCRL centralized
certificate revocation
* some more behaviour changes for TLS

The following vulnerabilities were fixed in Mozilla Thunderbird:

* Miscellaneous memory safety hazards (MFSA
2015-30/CVE-2015-0814/CVE-2015-0815 boo#925392)
* Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA
2015-31/CVE-2015-0813 bmo#1106596 boo#925393)
* resource:// documents can load privileged pages (MFSA
2015-33/CVE-2015-0816 bmo#1144991 boo#925395)
* CORS requests should not follow 30x redirections after preflight
(MFSA-2015-37/CVE-2015-0807 bmo#1111834 boo#925398)
* Same-origin bypass through anchor navigation (MFSA-2015-40/CVE-2015-0801
bmo#1146339 boo#925401)

mozilla-nspr was updated to 4.10.8 as a dependency and received the
following changes:
* bmo#573192: remove the stack-based PRFileDesc cache.
* bmo#756047: check for _POSIX_THREAD_PRIORITY_SCHEDULING > 0 instead of
only checking if the identifier is defined.
* bmo#1089908: Fix variable shadowing in _PR_MD_LOCKFILE. Use
PR_ARRAY_SIZE to get the array size of _PR_RUNQ(t->cpu).
* bmo#1106600: Replace PR_ASSERT(!”foo”) with PR_NOT_REACHED(“foo”) to
fix clang -Wstring-conversion warnings.

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.2:

zypper in -t patch openSUSE-2015-290=1

– openSUSE 13.1:

zypper in -t patch openSUSE-2015-290=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.2 (i586 x86_64):

MozillaFirefox-37.0.1-23.1
MozillaFirefox-branding-upstream-37.0.1-23.1
MozillaFirefox-buildsymbols-37.0.1-23.1
MozillaFirefox-debuginfo-37.0.1-23.1
MozillaFirefox-debugsource-37.0.1-23.1
MozillaFirefox-devel-37.0.1-23.1
MozillaFirefox-translations-common-37.0.1-23.1
MozillaFirefox-translations-other-37.0.1-23.1
MozillaThunderbird-31.6.0-15.3
MozillaThunderbird-buildsymbols-31.6.0-15.3
MozillaThunderbird-debuginfo-31.6.0-15.3
MozillaThunderbird-debugsource-31.6.0-15.3
MozillaThunderbird-devel-31.6.0-15.3
MozillaThunderbird-translations-common-31.6.0-15.3
MozillaThunderbird-translations-other-31.6.0-15.3
mozilla-nspr-4.10.8-6.1
mozilla-nspr-debuginfo-4.10.8-6.1
mozilla-nspr-debugsource-4.10.8-6.1
mozilla-nspr-devel-4.10.8-6.1

– openSUSE 13.2 (x86_64):

mozilla-nspr-32bit-4.10.8-6.1
mozilla-nspr-debuginfo-32bit-4.10.8-6.1

– openSUSE 13.1 (i586 x86_64):

MozillaFirefox-37.0.1-68.1
MozillaFirefox-branding-upstream-37.0.1-68.1
MozillaFirefox-buildsymbols-37.0.1-68.1
MozillaFirefox-debuginfo-37.0.1-68.1
MozillaFirefox-debugsource-37.0.1-68.1
MozillaFirefox-devel-37.0.1-68.1
MozillaFirefox-translations-common-37.0.1-68.1
MozillaFirefox-translations-other-37.0.1-68.1
MozillaThunderbird-31.6.0-70.50.2
MozillaThunderbird-buildsymbols-31.6.0-70.50.2
MozillaThunderbird-debuginfo-31.6.0-70.50.2
MozillaThunderbird-debugsource-31.6.0-70.50.2
MozillaThunderbird-devel-31.6.0-70.50.2
MozillaThunderbird-translations-common-31.6.0-70.50.2
MozillaThunderbird-translations-other-31.6.0-70.50.2
mozilla-nspr-4.10.8-22.1
mozilla-nspr-debuginfo-4.10.8-22.1
mozilla-nspr-debugsource-4.10.8-22.1
mozilla-nspr-devel-4.10.8-22.1

– openSUSE 13.1 (x86_64):

mozilla-nspr-32bit-4.10.8-22.1
mozilla-nspr-debuginfo-32bit-4.10.8-22.1

References:

https://www.suse.com/security/cve/CVE-2015-0799.html
https://www.suse.com/security/cve/CVE-2015-0801.html
https://www.suse.com/security/cve/CVE-2015-0802.html
https://www.suse.com/security/cve/CVE-2015-0803.html
https://www.suse.com/security/cve/CVE-2015-0804.html
https://www.suse.com/security/cve/CVE-2015-0805.html
https://www.suse.com/security/cve/CVE-2015-0806.html
https://www.suse.com/security/cve/CVE-2015-0807.html
https://www.suse.com/security/cve/CVE-2015-0808.html
https://www.suse.com/security/cve/CVE-2015-0811.html
https://www.suse.com/security/cve/CVE-2015-0812.html
https://www.suse.com/security/cve/CVE-2015-0813.html
https://www.suse.com/security/cve/CVE-2015-0814.html
https://www.suse.com/security/cve/CVE-2015-0815.html
https://www.suse.com/security/cve/CVE-2015-0816.html
https://bugzilla.suse.com/925368
https://bugzilla.suse.com/925392
https://bugzilla.suse.com/925393
https://bugzilla.suse.com/925394
https://bugzilla.suse.com/925395
https://bugzilla.suse.com/925396
https://bugzilla.suse.com/925397
https://bugzilla.suse.com/925398
https://bugzilla.suse.com/925399
https://bugzilla.suse.com/925400
https://bugzilla.suse.com/925401
https://bugzilla.suse.com/925402
https://bugzilla.suse.com/926166

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org