SUSE-SU-2016:2131-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2016/suse-su-20162131-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2016:2131-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2016:2131-1
Related
Published
2016-08-22T14:37:43Z
Modified
2016-08-22T14:37:43Z
Summary
Security update for MozillaFirefox
Details

MozillaFirefox was updated to 45.3.0 ESR to fix the following issues (bsc#991809):

  • MFSA 2016-62/CVE-2016-2835/CVE-2016-2836 Miscellaneous memory safety hazards (rv:48.0 / rv:45.3)
  • MFSA 2016-63/CVE-2016-2830 Favicon network connection can persist when page is closed
  • MFSA 2016-64/CVE-2016-2838 Buffer overflow rendering SVG with bidirectional content
  • MFSA 2016-65/CVE-2016-2839 Cairo rendering crash due to memory allocation issue with FFmpeg 0.10
  • MFSA 2016-67/CVE-2016-5252 Stack underflow during 2D graphics rendering
  • MFSA 2016-70/CVE-2016-5254 Use-after-free when using alt key and toplevel menus
  • MFSA 2016-72/CVE-2016-5258 Use-after-free in DTLS during WebRTC session shutdown
  • MFSA 2016-73/CVE-2016-5259 Use-after-free in service workers with nested sync events
  • MFSA 2016-76/CVE-2016-5262 Scripts on marquee tag can execute in sandboxed iframes
  • MFSA 2016-77/CVE-2016-2837 Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback
  • MFSA 2016-78/CVE-2016-5263 Type confusion in display transformation
  • MFSA 2016-79/CVE-2016-5264 Use-after-free when applying SVG effects
  • MFSA 2016-80/CVE-2016-5265 Same-origin policy violation using local HTML file and saved shortcut file
  • CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Also a temporary workaround was added: - Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

References

Affected packages

SUSE:Linux Enterprise Desktop 12 SP1 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.3.0esr-78.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "45.3.0esr-78.1",
            "MozillaFirefox-translations": "45.3.0esr-78.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.3.0esr-78.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "45.3.0esr-78.1",
            "MozillaFirefox-translations": "45.3.0esr-78.1"
        }
    ]
}

SUSE:Linux Enterprise Software Development Kit 12 SP1 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.3.0esr-78.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox-devel": "45.3.0esr-78.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12-LTSS / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.3.0esr-78.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "45.3.0esr-78.1",
            "MozillaFirefox-translations": "45.3.0esr-78.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.3.0esr-78.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "45.3.0esr-78.1",
            "MozillaFirefox-translations": "45.3.0esr-78.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
45.3.0esr-78.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "45.3.0esr-78.1",
            "MozillaFirefox-translations": "45.3.0esr-78.1"
        }
    ]
}