Описание
Security update for MozillaFirefox, mozilla-nspr, mozilla-nss
This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:
Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894), fixing following security issues:
- MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)
- MFSA 2016-17/CVE-2016-1954 Local file overwriting and potential privilege escalation through CSP reports
- MFSA 2016-20/CVE-2016-1957 Memory leak in libstagefright when deleting an array during MP4 processing
- MFSA 2016-21/CVE-2016-1958 Displayed page address can be overridden
- MFSA 2016-23/CVE-2016-1960 Use-after-free in HTML5 string parser
- MFSA 2016-24/CVE-2016-1961 Use-after-free in SetBody
- MFSA 2016-25/CVE-2016-1962 Use-after-free when using multiple WebRTC data channels
- MFSA 2016-27/CVE-2016-1964 Use-after-free during XML transformations
- MFSA 2016-28/CVE-2016-1965 Addressbar spoofing though history navigation and Location protocol property
- MFSA 2016-31/CVE-2016-1966 Memory corruption with malicious NPAPI plugin
- MFSA 2016-34/CVE-2016-1974 Out-of-bounds read in HTML parser following a failed allocation
- MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1 decoding in NSS
- MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font vulnerabilities in the Graphite 2 library
Mozilla NSPR was updated to version 4.12 (bsc#969894), fixing following bugs:
- added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code.
- fixed a memory allocation bug related to the PR_*printf functions
- exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9
- added support for FreeBSD aarch64
- several minor correctness and compatibility fixes
Mozilla NSS was updated to fix security issues (bsc#969894):
- MFSA 2016-15/CVE-2016-1978 Use-after-free in NSS during SSL connections in low memory
- MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1 decoding in NSS
- MFSA 2016-36/CVE-2016-1979 Use-after-free during processing of DER encoded keys in NSS
Список пакетов
SUSE Linux Enterprise Server 11 SP2-LTSS
Ссылки
- Link for SUSE-SU-2016:0909-1
- E-Mail link for SUSE-SU-2016:0909-1
- SUSE Security Ratings
- SUSE Bug 969894
- SUSE CVE CVE-2016-1950 page
- SUSE CVE CVE-2016-1952 page
- SUSE CVE CVE-2016-1953 page
- SUSE CVE CVE-2016-1954 page
- SUSE CVE CVE-2016-1957 page
- SUSE CVE CVE-2016-1958 page
- SUSE CVE CVE-2016-1960 page
- SUSE CVE CVE-2016-1961 page
- SUSE CVE CVE-2016-1962 page
- SUSE CVE CVE-2016-1964 page
- SUSE CVE CVE-2016-1965 page
- SUSE CVE CVE-2016-1966 page
- SUSE CVE CVE-2016-1974 page
- SUSE CVE CVE-2016-1977 page
- SUSE CVE CVE-2016-1978 page
- SUSE CVE CVE-2016-1979 page
Описание
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
Затронутые продукты
Ссылки
- CVE-2016-1950
- SUSE Bug 969894
- SUSE Bug 970257
- SUSE Bug 970377
- SUSE Bug 970378
- SUSE Bug 970379
- SUSE Bug 970380
- SUSE Bug 970381
- SUSE Bug 970431
- SUSE Bug 970433
Описание
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Затронутые продукты
Ссылки
- CVE-2016-1952
- SUSE Bug 969894
Описание
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to js/src/jit/arm/Assembler-arm.cpp, and unknown other vectors.
Затронутые продукты
Ссылки
- CVE-2016-1953
- SUSE Bug 969894
Описание
The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not prevent use of a non-HTTP report-uri for a Content Security Policy (CSP) violation report, which allows remote attackers to cause a denial of service (data overwrite) or possibly gain privileges by specifying a URL of a local file.
Затронутые продукты
Ссылки
- CVE-2016-1954
- SUSE Bug 969894
Описание
Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to cause a denial of service (memory consumption) via an MPEG-4 file that triggers a delete operation on an array.
Затронутые продукты
Ссылки
- CVE-2016-1957
- SUSE Bug 969894
Описание
browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to spoof the address bar via a javascript: URL.
Затронутые продукты
Ссылки
- CVE-2016-1958
- SUSE Bug 969894
Описание
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as demonstrated by incorrect SVG processing, aka ZDI-CAN-3545.
Затронутые продукты
Ссылки
- CVE-2016-1960
- SUSE Bug 969894
Описание
Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of a root element, aka ZDI-CAN-3574.
Затронутые продукты
Ссылки
- CVE-2016-1961
- SUSE Bug 969894
Описание
Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code by leveraging mishandling of WebRTC data-channel connections.
Затронутые продукты
Ссылки
- CVE-2016-1962
- SUSE Bug 969894
Описание
Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging mishandling of XML transformations.
Затронутые продукты
Ссылки
- CVE-2016-1964
- SUSE Bug 969894
Описание
Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the original page, which allows remote attackers to spoof the address bar via vectors involving the history.back method and the location.protocol property.
Затронутые продукты
Ссылки
- CVE-2016-1965
- SUSE Bug 969894
Описание
The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference and memory corruption) via a crafted NPAPI plugin.
Затронутые продукты
Ссылки
- CVE-2016-1966
- SUSE Bug 969894
Описание
The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not verify that memory allocation succeeds, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via crafted Unicode data in an HTML, XML, or SVG document.
Затронутые продукты
Ссылки
- CVE-2016-1974
- SUSE Bug 969894
Описание
The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-1977
- SUSE Bug 969894
Описание
Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange function in Mozilla Network Security Services (NSS) before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact by making an SSL (1) DHE or (2) ECDHE handshake at a time of high memory consumption.
Затронутые продукты
Ссылки
- CVE-2016-1978
- SUSE Bug 969894
Описание
Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey function in Mozilla Network Security Services (NSS) before 3.21.1, as used in Mozilla Firefox before 45.0, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted key data with DER encoding.
Затронутые продукты
Ссылки
- CVE-2016-1979
- SUSE Bug 969894
Описание
The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2790
- SUSE Bug 969894
Описание
The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2791
- SUSE Bug 969894
Описание
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2800.
Затронутые продукты
Ссылки
- CVE-2016-2792
- SUSE Bug 969894
Описание
CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2793
- SUSE Bug 969894
Описание
The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2794
- SUSE Bug 969894
Описание
The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, does not initialize memory for an unspecified data structure, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2795
- SUSE Bug 969894
Описание
Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2796
- SUSE Bug 969894
Описание
The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2801.
Затронутые продукты
Ссылки
- CVE-2016-2797
- SUSE Bug 969894
Описание
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2798
- SUSE Bug 969894
Описание
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2799
- SUSE Bug 969894
Описание
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
Затронутые продукты
Ссылки
- CVE-2016-2800
- SUSE Bug 969894
Описание
The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.
Затронутые продукты
Ссылки
- CVE-2016-2801
- SUSE Bug 969894
Описание
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
Затронутые продукты
Ссылки
- CVE-2016-2802
- SUSE Bug 969894