Jump to content
Compatible Support Forums
Sign in to follow this  
news

[security-announce] SUSE-SU-2015:1476-1: important: Security update for MozillaFirefox, mozilla-nss

Recommended Posts

SUSE Security Update: Security update for MozillaFirefox, mozilla-nss

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2015:1476-1

Rating: important

References: #940806 #943557 #943558 #943608

Cross-References: CVE-2015-4473 CVE-2015-4474 CVE-2015-4475

CVE-2015-4478 CVE-2015-4479 CVE-2015-4484

CVE-2015-4485 CVE-2015-4486 CVE-2015-4487

CVE-2015-4488 CVE-2015-4489 CVE-2015-4491

CVE-2015-4492 CVE-2015-4495 CVE-2015-4497

CVE-2015-4498

Affected Products:

SUSE Linux Enterprise Software Development Kit 12

SUSE Linux Enterprise Server 12

SUSE Linux Enterprise Desktop 12

______________________________________________________________________________

 

An update that fixes 16 vulnerabilities is now available.

 

Description:

 

 

Mozilla Firefox was updated to version 38.2.1 ESR to fix several critical

and non critical security vulnerabilities.

 

- Firefox was updated to 38.2.1 ESR (bsc#943608)

* MFSA 2015-94/CVE-2015-4497 (bsc#943557) Use-after-free when resizing

canvas element during restyling

* MFSA 2015-95/CVE-2015-4498 (bsc#943558) Add-on notification bypass

through data URLs

 

- Firefox was updated to 38.2.0 ESR (bsc#940806)

* MFSA 2015-78/CVE-2015-4495 (bmo#1178058, bmo#1179262) Same origin

violation and local file stealing via PDF reader

* MFSA 2015-79/CVE-2015-4473/CVE-2015-4474 (bmo#1143130, bmo#1161719,

bmo#1177501, bmo#1181204, bmo#1184068, bmo#1188590, bmo#1146213,

bmo#1178890, bmo#1182711) Miscellaneous memory safety hazards (rv:40.0

/ rv:38.2)

* MFSA 2015-80/CVE-2015-4475 (bmo#1175396) Out-of-bounds read with

malformed MP3 file

* MFSA 2015-82/CVE-2015-4478 (bmo#1105914) Redefinition of

non-configurable JavaScript object properties

* MFSA 2015-83/CVE-2015-4479 (bmo#1185115, bmo#1144107, bmo#1170344,

bmo#1186718) Overflow issues in libstagefright

* MFSA 2015-87/CVE-2015-4484 (bmo#1171540) Crash when using shared

memory in JavaScript

* MFSA 2015-88/CVE-2015-4491 (bmo#1184009) Heap overflow in gdk-pixbuf

when scaling bitmap images

* MFSA 2015-89/CVE-2015-4485/CVE-2015-4486 (bmo#1177948, bmo#1178148)

Buffer overflows on Libvpx when decoding WebM video

* MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 (bmo#1176270,

bmo#1182723, bmo#1171603) Vulnerabilities found through code inspection

* MFSA 2015-92/CVE-2015-4492 (bmo#1185820) Use-after-free in

XMLHttpRequest with shared workers

 

Mozilla NSS switched the CKBI ABI from 1.98 to 2.4, which is what Firefox

38ESR uses.

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Software Development Kit 12:

 

zypper in -t patch SUSE-SLE-SDK-12-2015-472=1

 

- SUSE Linux Enterprise Server 12:

 

zypper in -t patch SUSE-SLE-SERVER-12-2015-472=1

 

- SUSE Linux Enterprise Desktop 12:

 

zypper in -t patch SUSE-SLE-DESKTOP-12-2015-472=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64):

 

MozillaFirefox-debuginfo-38.2.1esr-45.1

MozillaFirefox-debugsource-38.2.1esr-45.1

MozillaFirefox-devel-38.2.1esr-45.1

mozilla-nss-debuginfo-3.19.2.0-26.2

mozilla-nss-debugsource-3.19.2.0-26.2

mozilla-nss-devel-3.19.2.0-26.2

 

- SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64):

 

MozillaFirefox-38.2.1esr-45.1

MozillaFirefox-branding-SLE-31.0-14.1

MozillaFirefox-debuginfo-38.2.1esr-45.1

MozillaFirefox-debugsource-38.2.1esr-45.1

MozillaFirefox-translations-38.2.1esr-45.1

libfreebl3-3.19.2.0-26.2

libfreebl3-debuginfo-3.19.2.0-26.2

libfreebl3-hmac-3.19.2.0-26.2

libsoftokn3-3.19.2.0-26.2

libsoftokn3-debuginfo-3.19.2.0-26.2

libsoftokn3-hmac-3.19.2.0-26.2

mozilla-nss-3.19.2.0-26.2

mozilla-nss-certs-3.19.2.0-26.2

mozilla-nss-certs-debuginfo-3.19.2.0-26.2

mozilla-nss-debuginfo-3.19.2.0-26.2

mozilla-nss-debugsource-3.19.2.0-26.2

mozilla-nss-tools-3.19.2.0-26.2

mozilla-nss-tools-debuginfo-3.19.2.0-26.2

 

- SUSE Linux Enterprise Server 12 (s390x x86_64):

 

libfreebl3-32bit-3.19.2.0-26.2

libfreebl3-debuginfo-32bit-3.19.2.0-26.2

libfreebl3-hmac-32bit-3.19.2.0-26.2

libsoftokn3-32bit-3.19.2.0-26.2

libsoftokn3-debuginfo-32bit-3.19.2.0-26.2

libsoftokn3-hmac-32bit-3.19.2.0-26.2

mozilla-nss-32bit-3.19.2.0-26.2

mozilla-nss-certs-32bit-3.19.2.0-26.2

mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2

mozilla-nss-debuginfo-32bit-3.19.2.0-26.2

 

- SUSE Linux Enterprise Desktop 12 (x86_64):

 

MozillaFirefox-38.2.1esr-45.1

MozillaFirefox-branding-SLE-31.0-14.1

MozillaFirefox-debuginfo-38.2.1esr-45.1

MozillaFirefox-debugsource-38.2.1esr-45.1

MozillaFirefox-translations-38.2.1esr-45.1

libfreebl3-3.19.2.0-26.2

libfreebl3-32bit-3.19.2.0-26.2

libfreebl3-debuginfo-3.19.2.0-26.2

libfreebl3-debuginfo-32bit-3.19.2.0-26.2

libsoftokn3-3.19.2.0-26.2

libsoftokn3-32bit-3.19.2.0-26.2

libsoftokn3-debuginfo-3.19.2.0-26.2

libsoftokn3-debuginfo-32bit-3.19.2.0-26.2

mozilla-nss-3.19.2.0-26.2

mozilla-nss-32bit-3.19.2.0-26.2

mozilla-nss-certs-3.19.2.0-26.2

mozilla-nss-certs-32bit-3.19.2.0-26.2

mozilla-nss-certs-debuginfo-3.19.2.0-26.2

mozilla-nss-certs-debuginfo-32bit-3.19.2.0-26.2

mozilla-nss-debuginfo-3.19.2.0-26.2

mozilla-nss-debuginfo-32bit-3.19.2.0-26.2

mozilla-nss-debugsource-3.19.2.0-26.2

mozilla-nss-tools-3.19.2.0-26.2

mozilla-nss-tools-debuginfo-3.19.2.0-26.2

 

 

References:

 

https://www.suse.com/security/cve/CVE-2015-4473.html

https://www.suse.com/security/cve/CVE-2015-4474.html

https://www.suse.com/security/cve/CVE-2015-4475.html

https://www.suse.com/security/cve/CVE-2015-4478.html

https://www.suse.com/security/cve/CVE-2015-4479.html

https://www.suse.com/security/cve/CVE-2015-4484.html

https://www.suse.com/security/cve/CVE-2015-4485.html

https://www.suse.com/security/cve/CVE-2015-4486.html

https://www.suse.com/security/cve/CVE-2015-4487.html

https://www.suse.com/security/cve/CVE-2015-4488.html

https://www.suse.com/security/cve/CVE-2015-4489.html

https://www.suse.com/security/cve/CVE-2015-4491.html

https://www.suse.com/security/cve/CVE-2015-4492.html

https://www.suse.com/security/cve/CVE-2015-4495.html

https://www.suse.com/security/cve/CVE-2015-4497.html

https://www.suse.com/security/cve/CVE-2015-4498.html

https://bugzilla.suse.com/940806

https://bugzilla.suse.com/943557

https://bugzilla.suse.com/943558

https://bugzilla.suse.com/943608

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

 

 

 

Share this post


Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  

×