You are here
Home > Preporuke > Sigurnosni nedostaci programskih paketa Mozilla Firefox, Thunderbird i NSS

Sigurnosni nedostaci programskih paketa Mozilla Firefox, Thunderbird i NSS

by ncert - 0

openSUSE Security Update: Security update for Mozilla Firefox, Thunderbird and NSS
______________________________________________________________________________

Announcement ID: openSUSE-SU-2016:3011-1
Rating: important
References: #1009026 #1010401 #1010404 #1010410 #1010411
#1010427 #1012807 #1012964
Cross-References: CVE-2016-5289 CVE-2016-5290 CVE-2016-5291
CVE-2016-5292 CVE-2016-5293 CVE-2016-5294
CVE-2016-5295 CVE-2016-5296 CVE-2016-5297
CVE-2016-5298 CVE-2016-5299 CVE-2016-9061
CVE-2016-9062 CVE-2016-9063 CVE-2016-9064
CVE-2016-9065 CVE-2016-9066 CVE-2016-9067
CVE-2016-9068 CVE-2016-9069 CVE-2016-9070
CVE-2016-9071 CVE-2016-9072 CVE-2016-9073
CVE-2016-9074 CVE-2016-9075 CVE-2016-9076
CVE-2016-9077 CVE-2016-9078 CVE-2016-9079

Affected Products:
openSUSE 13.1
______________________________________________________________________________

An update that fixes 30 vulnerabilities is now available.

Description:

This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS 3.16.2
fixes a number of security issues.

The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89):

– CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1
(bmo#1292443)
– CVE-2016-5292: URL parsing causes crash (bmo#1288482)
– CVE-2016-5297: Incorrect argument length checking in Javascript
(bmo#1303678)
– CVE-2016-9064: Addons update must verify IDs match between current
and new versions (bmo#1303418)
– CVE-2016-9066: Integer overflow leading to a buffer overflow in
nsScriptLoadHandler (bmo#1299686)
– CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore
(bmo#1301777, bmo#1308922 (CVE-2016-9069))
– CVE-2016-9068: heap-use-after-free in nsRefreshDriver (bmo#1302973)
– CVE-2016-9075: WebExtensions can access the mozAddonManager API and
use it to gain elevated privileges (bmo#1295324)
– CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied
to cross-origin images, allowing timing attacks on them (bmo#1298552)
– CVE-2016-5291: Same-origin policy violation using local HTML file and
saved shortcut file (bmo#1292159)
– CVE-2016-9070: Sidebar bookmark can have reference to chrome window
(bmo#1281071)
– CVE-2016-9073: windows.create schema doesn’t specify “format”:
“relativeUrl” (bmo#1289273)
– CVE-2016-9076: select dropdown menu can be used for URL bar spoofing
on e10s (bmo#1276976)
– CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in
expat (bmo#1274777)
– CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP
(bmo#1285003)
– CVE-2016-5289: Memory safety bugs fixed in Firefox 50
– CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR
45.5

The following vulnerabilities were fixed in Mozilla NSS 3.26.1:

– CVE-2016-9074: Insufficient timing side-channel resistance in
divSpoiler (bmo#1293334)

Mozilla Firefox now requires mozilla-nss 3.26.2.

New features in Mozilla Firefox:

– Updates to keyboard shortcuts Set a preference to have Ctrl+Tab cycle
through tabs in recently used order View a page in Reader Mode by
using Ctrl+Alt+R
– Added option to Find in page that allows users to limit search to
whole words only
– Added download protection for a large number of executable file types
on Windows, Mac and Linux
– Fixed rendering of dashed and dotted borders with rounded corners
(border-radius)
– Added a built-in Emoji set for operating systems without native Emoji
fonts
– Blocked versions of libavcodec older than 54.35.1
– additional locale

mozilla-nss was updated to 3.26.2, incorporating the following changes:

– the selfserv test utility has been enhanced to support ALPN
(HTTP/1.1) and 0-RTT
– The following CA certificate was added: CN = ISRG Root X1
– NPN is disabled and ALPN is enabled by default
– MD5 signature algorithms sent by the server in CertificateRequest
messages are now properly ignored

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– openSUSE 13.1:

zypper in -t patch 2016-1407=1

To bring your system up-to-date, use “zypper patch”.

Package List:

– openSUSE 13.1 (i586 x86_64):

MozillaFirefox-50.0.2-131.1
MozillaFirefox-branding-upstream-50.0.2-131.1
MozillaFirefox-buildsymbols-50.0.2-131.1
MozillaFirefox-debuginfo-50.0.2-131.1
MozillaFirefox-debugsource-50.0.2-131.1
MozillaFirefox-devel-50.0.2-131.1
MozillaFirefox-translations-common-50.0.2-131.1
MozillaFirefox-translations-other-50.0.2-131.1
MozillaThunderbird-45.5.1-70.92.1
MozillaThunderbird-buildsymbols-45.5.1-70.92.1
MozillaThunderbird-debuginfo-45.5.1-70.92.1
MozillaThunderbird-debugsource-45.5.1-70.92.1
MozillaThunderbird-devel-45.5.1-70.92.1
MozillaThunderbird-translations-common-45.5.1-70.92.1
MozillaThunderbird-translations-other-45.5.1-70.92.1
libfreebl3-3.26.2-94.1
libfreebl3-debuginfo-3.26.2-94.1
libsoftokn3-3.26.2-94.1
libsoftokn3-debuginfo-3.26.2-94.1
mozilla-nss-3.26.2-94.1
mozilla-nss-certs-3.26.2-94.1
mozilla-nss-certs-debuginfo-3.26.2-94.1
mozilla-nss-debuginfo-3.26.2-94.1
mozilla-nss-debugsource-3.26.2-94.1
mozilla-nss-devel-3.26.2-94.1
mozilla-nss-sysinit-3.26.2-94.1
mozilla-nss-sysinit-debuginfo-3.26.2-94.1
mozilla-nss-tools-3.26.2-94.1
mozilla-nss-tools-debuginfo-3.26.2-94.1

– openSUSE 13.1 (x86_64):

libfreebl3-32bit-3.26.2-94.1
libfreebl3-debuginfo-32bit-3.26.2-94.1
libsoftokn3-32bit-3.26.2-94.1
libsoftokn3-debuginfo-32bit-3.26.2-94.1
mozilla-nss-32bit-3.26.2-94.1
mozilla-nss-certs-32bit-3.26.2-94.1
mozilla-nss-certs-debuginfo-32bit-3.26.2-94.1
mozilla-nss-debuginfo-32bit-3.26.2-94.1
mozilla-nss-sysinit-32bit-3.26.2-94.1
mozilla-nss-sysinit-debuginfo-32bit-3.26.2-94.1

References:

https://www.suse.com/security/cve/CVE-2016-5289.html
https://www.suse.com/security/cve/CVE-2016-5290.html
https://www.suse.com/security/cve/CVE-2016-5291.html
https://www.suse.com/security/cve/CVE-2016-5292.html
https://www.suse.com/security/cve/CVE-2016-5293.html
https://www.suse.com/security/cve/CVE-2016-5294.html
https://www.suse.com/security/cve/CVE-2016-5295.html
https://www.suse.com/security/cve/CVE-2016-5296.html
https://www.suse.com/security/cve/CVE-2016-5297.html
https://www.suse.com/security/cve/CVE-2016-5298.html
https://www.suse.com/security/cve/CVE-2016-5299.html
https://www.suse.com/security/cve/CVE-2016-9061.html
https://www.suse.com/security/cve/CVE-2016-9062.html
https://www.suse.com/security/cve/CVE-2016-9063.html
https://www.suse.com/security/cve/CVE-2016-9064.html
https://www.suse.com/security/cve/CVE-2016-9065.html
https://www.suse.com/security/cve/CVE-2016-9066.html
https://www.suse.com/security/cve/CVE-2016-9067.html
https://www.suse.com/security/cve/CVE-2016-9068.html
https://www.suse.com/security/cve/CVE-2016-9069.html
https://www.suse.com/security/cve/CVE-2016-9070.html
https://www.suse.com/security/cve/CVE-2016-9071.html
https://www.suse.com/security/cve/CVE-2016-9072.html
https://www.suse.com/security/cve/CVE-2016-9073.html
https://www.suse.com/security/cve/CVE-2016-9074.html
https://www.suse.com/security/cve/CVE-2016-9075.html
https://www.suse.com/security/cve/CVE-2016-9076.html
https://www.suse.com/security/cve/CVE-2016-9077.html
https://www.suse.com/security/cve/CVE-2016-9078.html
https://www.suse.com/security/cve/CVE-2016-9079.html
https://bugzilla.suse.com/1009026
https://bugzilla.suse.com/1010401
https://bugzilla.suse.com/1010404
https://bugzilla.suse.com/1010410
https://bugzilla.suse.com/1010411
https://bugzilla.suse.com/1010427
https://bugzilla.suse.com/1012807
https://bugzilla.suse.com/1012964

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

ncert
Top
More in Preporuke
Sigurnosni nedostaci programskog paketa util-linux

Otkriven je sigurnosni nedostatak u programskom paketu util-linux za operacijski sustav Gentoo. Otkriveni nedostatak potencijalnim napadačima omogućuje izvođenje napada uskraćivanja...

Close