LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: December 19th, 2014
Linux Advisory Watch: December 12th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
SuSE: 2011-037: Mozilla Firefox Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
SuSE Mozilla released a round of security updates. Mozilla Firefox was updated to version 6 on openSUSE 11.4, Mozilla Firefox was updated to version 3.6.20 on openSUSE 11.3 and SUSE Linux Enterprise 10 and 11. Seamonkey was updated to 2.3 on openSUSE 11.3,11.4 [More...]
______________________________________________________________________________

                        SUSE Security Announcement

        Package:                MozillaFirefox,MozillaThunderbird,seamonkey
        Announcement ID:        SUSE-SA:2011:037
        Date:                   Mon, 29 Aug 2011 12:00:00 +0000
        Affected Products:      openSUSE 11.3
                                openSUSE 11.4
                                SUSE Linux Enterprise Server 11 SP1
                                SUSE Linux Enterprise Desktop 11 SP1
                                SUSE Linux Enterprise Server 10 SP4
                                SUSE Linux Enterprise Desktop 10 SP4
                                SUSE Linux Enterprise Server 10 SP3
                                SLE SDK 10 SP3
                                SLE SDK 10 SP4
                                SUSE Linux Enterprise Software Development Kit 11 SP1
        Vulnerability Type:     remote code execution
        CVSS v2 Base Score:     6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
        SUSE Default Package:   yes
        Cross-References:       CVE-2011-0084, CVE-2011-2378, CVE-2011-2980
                                CVE-2011-2981, CVE-2011-2982, CVE-2011-2983
                                CVE-2011-2984, CVE-2011-2985, CVE-2011-2986
                                CVE-2011-2987, CVE-2011-2988, CVE-2011-2989
                                CVE-2011-2990, CVE-2011-2991, CVE-2011-2992
                                CVE-2011-2993, MFSA 2011-29, MFSA 2011-30
                                MFSA 2011-32, MFSA 2011-33

    Content of This Advisory:
        1) Security Vulnerability Resolved:
             Mozilla Firefox 3.6.20 / 6.0 security upgrade
           Problem Description
        2) Solution or Work-Around
        3) Special Instructions and Notes
        4) Package Location and Checksums
        5) Pending Vulnerabilities, Solutions, and Work-Arounds:
            none
        6) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Problem Description and Brief Discussion

   Mozilla released a round of security updates.

   Mozilla Firefox was updated to version 6 on openSUSE 11.4,
   Mozilla Firefox was updated to version 3.6.20 on openSUSE 11.3 and
   SUSE Linux Enterprise 10 and 11.
   Seamonkey was updated to 2.3 on openSUSE 11.3,11.4
   Mozilla Thunderbird was updated to 3.1.2 on openSUSE 11.3,11.4.
   Mozilla XULRunner was updated to 1.9.2.20.

   The updates bring new features, fix bugs and security issues.

   Mozilla Firefox 6:
   http://www.mozilla.org/security/announce/2011/mfsa2011-29.html
   Mozilla Firefox 3.6.20:
   http://www.mozilla.org/security/announce/2011/mfsa2011-30.html
   Mozilla Seamonkey 2.3:
   http://www.mozilla.org/security/announce/2011/mfsa2011-33.html
   Mozilla Thunderbird:
   http://www.mozilla.org/security/announce/2011/mfsa2011-32.html

   * Miscellaneous memory safety hazards:

     Mozilla identified and fixed several memory safety bugs in the
     browser engine used in Firefox 4, Firefox 5 and other Mozilla-based
     products. Some of these bugs showed evidence of memory corruption
     under certain circumstances, and we presume that with enough effort
     at least some of these could be exploited to run arbitrary code.

     Gary Kwong, Igor Bukanov, Nils and Bob Clary reported memory safety
     issues which affected Thunderbird 3.1. (CVE-2011-2982)

     Aral Yaman reported a WebGL crash which affected Firefox 4 and
     Firefox 5. (CVE-2011-2989)

     Vivekanand Bolajwar reported a JavaScript crash which affected
     Firefox 4 and Firefox 5. (CVE-2011-2991)

     Bert Hubert and Theo Snelleman of Fox-IT reported a crash in the
     OGG reader which affected Firefox 4 and Firefox 5. (CVE-2011-2992)

     Mozilla developers and community members Robert Kaiser, Jesse
     Ruderman, moz_bug_r_a4, Mardeg, Gary Kwong, Christoph Diehl, Martijn
     Wargers, Travis Emmitt, Bob Clary and Jonathan Watt reported memory
     safety issues which affected Firefox 4 and Firefox 5. (CVE-2011-2985)


   * Unsigned scripts can call script inside signed JAR

     Rafael Gieschke reported that unsigned JavaScript could call into
     script inside a signed JAR thereby inheriting the identity of the
     site that signed the JAR as well as any permissions that a user
     had granted the signed JAR. (CVE-2011-2993)


   * String crash using WebGL shaders

     Michael Jordon of Context IS reported that an overly long shader
     program could cause a buffer overrun and crash in a string class
     used to store the shader source code. (CVE-2011-2988)


   * Heap overflow in ANGLE library

     Michael Jordon of Context IS reported a potentially exploitable heap
     overflow in the ANGLE library used by Mozilla's WebGL
     implementation. (CVE-2011-2987)


   * Crash in SVGTextElement.getCharNumAtPosition()

     Security researcher regenrecht reported via TippingPoint's Zero
     Day Initiative that a SVG text manipulation routine contained a
     dangling pointer vulnerability. (CVE-2011-0084)


   * Credential leakage using Content Security Policy reports

     Mike Cardwell reported that Content Security Policy violation reports
     failed to strip out proxy authorization credentials from the list
     of request headers. Daniel Veditz reported that redirecting to
     a website with Content Security Policy resulted in the incorrect
     resolution of hosts in the constructed policy. (CVE-2011-2990)


   * Cross-origin data theft using canvas and Windows D2D

     nasalislarvatus3000 reported that when using Windows D2D hardware
     acceleration, image data from one domain could be inserted into a
     canvas and read by a different domain. (CVE-2011-2986)


   * Privilege escalation using event handlers

     Mozilla security researcher moz_bug_r_a_4 reported a vulnerability
     in event management code that would permit JavaScript to be run
     in the wrong context, including that of a different website or
     potentially in a chrome-privileged context. (CVE-2011-2981)


   * Dangling pointer vulnerability in appendChild

     Security researcher regenrecht reported via TippingPoint's Zero
     Day Initiative that appendChild did not correctly account for DOM
     objects it operated upon and could be exploited to dereference an
     invalid pointer. (CVE-2011-2378)


   * Privilege escalation dropping a tab element in content area

     Mozilla security researcher moz_bug_r_a4 reported that web
     content could receive chrome privileges if it registered for drop
     events and a browser tab element was dropped into the content
     area. (CVE-2011-2984)


   * Binary planting vulnerability in ThinkPadSensor::Startup

     Security researcher Mitja Kolsek of Acros Security reported that
     ThinkPadSensor::Startup could potentially be exploited to load a
     malicious DLL into the running process. (CVE-2011-2980)
     This issue affects probably only MS Windows.


   * Private data leakage using RegExp.input

     Security researcher shutdown reported that data from other domains
     could be read when RegExp.input was set. (CVE-2011-2983)

2) Solution or Work-Around

   There is no known workaround, please install the update packages.

3) Special Instructions and Notes

   Please restart running instances of Mozilla Firefox/Thunderbird and/or seamonkey
   after the update.
4) Package Location and Checksums

   The preferred method for installing security updates is to use the YaST
   "Online Update" module or the "zypper" commandline tool. The package and
   patch management stack will detect which updates are required and
   automatically perform the necessary steps to verify and install them.

   Alternatively, download the update packages for your distribution manually
   and verify their integrity by the methods listed in Section 6 of this
   announcement. Then install the packages using the command

     rpm -Fhv 

   to apply the update, replacing  with the filename of the
   downloaded RPM package.


   x86 Platform:

   openSUSE 11.4:
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaFirefox-6.0-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaFirefox-branding-upstream-6.0-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaFirefox-buildsymbols-6.0-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaFirefox-devel-6.0-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaFirefox-translations-common-6.0-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaFirefox-translations-other-6.0-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaThunderbird-3.1.12-0.11.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaThunderbird-buildsymbols-3.1.12-0.11.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaThunderbird-devel-3.1.12-0.11.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaThunderbird-translations-common-3.1.12-0.11.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/MozillaThunderbird-translations-other-3.1.12-0.11.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/enigmail-1.1.2+3.1.12-0.11.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/libfreebl3-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/libsoftokn3-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-js192-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nspr-4.8.9-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nspr-devel-4.8.9-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nss-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nss-certs-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nss-devel-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nss-sysinit-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-nss-tools-3.12.11-1.3.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-xulrunner192-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-xulrunner192-buildsymbols-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-xulrunner192-devel-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-xulrunner192-gnome-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-xulrunner192-translations-common-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/mozilla-xulrunner192-translations-other-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/seamonkey-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/seamonkey-dom-inspector-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/seamonkey-irc-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/seamonkey-translations-common-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/seamonkey-translations-other-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.4/rpm/i586/seamonkey-venkman-2.3-2.2.1.i586.rpm

   openSUSE 11.3:
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaFirefox-3.6.20-0.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaFirefox-branding-upstream-3.6.20-0.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaFirefox-translations-common-3.6.20-0.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaFirefox-translations-other-3.6.20-0.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaThunderbird-3.1.12-0.15.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaThunderbird-devel-3.1.12-0.15.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaThunderbird-translations-common-3.1.12-0.15.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/MozillaThunderbird-translations-other-3.1.12-0.15.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/enigmail-1.1.2+3.1.12-0.15.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/libfreebl3-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/libsoftokn3-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-js192-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nspr-4.8.9-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nspr-devel-4.8.9-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nss-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nss-certs-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nss-devel-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nss-sysinit-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-nss-tools-3.12.11-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-xulrunner192-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-xulrunner192-buildsymbols-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-xulrunner192-devel-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-xulrunner192-gnome-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-xulrunner192-translations-common-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/mozilla-xulrunner192-translations-other-1.9.2.20-1.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/seamonkey-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/seamonkey-dom-inspector-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/seamonkey-irc-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/seamonkey-translations-common-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/seamonkey-translations-other-2.3-2.2.1.i586.rpm
   http://download.opensuse.org/update/11.3/rpm/i586/seamonkey-venkman-2.3-2.2.1.i586.rpm

   x86-64 Platform:

   openSUSE 11.4:
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaFirefox-6.0-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaFirefox-branding-upstream-6.0-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaFirefox-buildsymbols-6.0-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaFirefox-devel-6.0-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaFirefox-translations-common-6.0-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaFirefox-translations-other-6.0-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaThunderbird-3.1.12-0.11.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaThunderbird-buildsymbols-3.1.12-0.11.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaThunderbird-devel-3.1.12-0.11.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaThunderbird-translations-common-3.1.12-0.11.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/MozillaThunderbird-translations-other-3.1.12-0.11.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/enigmail-1.1.2+3.1.12-0.11.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/libfreebl3-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/libfreebl3-32bit-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/libsoftokn3-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/libsoftokn3-32bit-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-js192-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-js192-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nspr-32bit-4.8.9-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nspr-4.8.9-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nspr-devel-4.8.9-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-32bit-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-certs-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-certs-32bit-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-devel-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-sysinit-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-sysinit-32bit-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-nss-tools-3.12.11-1.3.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-buildsymbols-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-devel-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-gnome-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-gnome-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-translations-common-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-translations-common-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-translations-other-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/mozilla-xulrunner192-translations-other-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/seamonkey-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/seamonkey-dom-inspector-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/seamonkey-irc-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/seamonkey-translations-common-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/seamonkey-translations-other-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.4/rpm/x86_64/seamonkey-venkman-2.3-2.2.1.x86_64.rpm

   openSUSE 11.3:
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaFirefox-3.6.20-0.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaFirefox-branding-upstream-3.6.20-0.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaFirefox-translations-common-3.6.20-0.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaFirefox-translations-other-3.6.20-0.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaThunderbird-3.1.12-0.15.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaThunderbird-devel-3.1.12-0.15.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaThunderbird-translations-common-3.1.12-0.15.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/MozillaThunderbird-translations-other-3.1.12-0.15.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/enigmail-1.1.2+3.1.12-0.15.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/libfreebl3-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/libfreebl3-32bit-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/libsoftokn3-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/libsoftokn3-32bit-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-js192-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-js192-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nspr-32bit-4.8.9-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nspr-4.8.9-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nspr-devel-4.8.9-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-32bit-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-certs-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-certs-32bit-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-devel-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-sysinit-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-sysinit-32bit-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-nss-tools-3.12.11-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-buildsymbols-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-devel-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-gnome-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-gnome-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-translations-common-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-translations-common-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-translations-other-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/mozilla-xulrunner192-translations-other-32bit-1.9.2.20-1.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/seamonkey-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/seamonkey-dom-inspector-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/seamonkey-irc-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/seamonkey-translations-common-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/seamonkey-translations-other-2.3-2.2.1.x86_64.rpm
   http://download.opensuse.org/update/11.3/rpm/x86_64/seamonkey-venkman-2.3-2.2.1.x86_64.rpm

   Sources:

   openSUSE 11.4:
   http://download.opensuse.org/update/11.4/rpm/src/MozillaFirefox-6.0-2.2.1.src.rpm
   http://download.opensuse.org/update/11.4/rpm/src/MozillaThunderbird-3.1.12-0.11.1.src.rpm
   http://download.opensuse.org/update/11.4/rpm/src/mozilla-nspr-4.8.9-1.3.1.src.rpm
   http://download.opensuse.org/update/11.4/rpm/src/mozilla-nss-3.12.11-1.3.1.src.rpm
   http://download.opensuse.org/update/11.4/rpm/src/mozilla-xulrunner192-1.9.2.20-1.2.1.src.rpm
   http://download.opensuse.org/update/11.4/rpm/src/seamonkey-2.3-2.2.1.src.rpm

   openSUSE 11.3:
   http://download.opensuse.org/update/11.3/rpm/src/MozillaFirefox-3.6.20-0.2.1.src.rpm
   http://download.opensuse.org/update/11.3/rpm/src/MozillaThunderbird-3.1.12-0.15.1.src.rpm
   http://download.opensuse.org/update/11.3/rpm/src/mozilla-nspr-4.8.9-1.2.1.src.rpm
   http://download.opensuse.org/update/11.3/rpm/src/mozilla-nss-3.12.11-1.2.1.src.rpm
   http://download.opensuse.org/update/11.3/rpm/src/mozilla-xulrunner192-1.9.2.20-1.2.1.src.rpm
   http://download.opensuse.org/update/11.3/rpm/src/seamonkey-2.3-2.2.1.src.rpm

   Our maintenance customers are notified individually. The packages are
   offered for installation from the maintenance web:

   SUSE Linux Enterprise Software Development Kit 11 SP1
     http://download.novell.com/patch/finder/?keywords=5c3516aa47640b1f3ca0aae0a2c8f067

   SUSE Linux Enterprise Desktop 11 SP1
     http://download.novell.com/patch/finder/?keywords=5c3516aa47640b1f3ca0aae0a2c8f067

   SUSE Linux Enterprise Server 11 SP1
     http://download.novell.com/patch/finder/?keywords=5c3516aa47640b1f3ca0aae0a2c8f067

   SUSE Linux Enterprise Server 10 SP3
     http://download.novell.com/patch/finder/?keywords=b2e45f3a2377c8c0b0d85d6e8dc698c3

   SLE SDK 10 SP3
     http://download.novell.com/patch/finder/?keywords=b2e45f3a2377c8c0b0d85d6e8dc698c3

   SUSE Linux Enterprise Desktop 10 SP4
     http://download.novell.com/patch/finder/?keywords=24df2ef0dad5f3b46261e6f99333badf

   SLE SDK 10 SP4
     http://download.novell.com/patch/finder/?keywords=24df2ef0dad5f3b46261e6f99333badf

   SUSE Linux Enterprise Server 10 SP4
     http://download.novell.com/patch/finder/?keywords=24df2ef0dad5f3b46261e6f99333badf

______________________________________________________________________________

5) Pending Vulnerabilities, Solutions, and Work-Arounds:

   none
______________________________________________________________________________

6) Authenticity Verification and Additional Information

  - Announcement authenticity verification:

    SUSE security announcements are published via mailing lists and on Web
    sites. The authenticity and integrity of a SUSE security announcement is
    guaranteed by a cryptographic signature in each announcement. All SUSE
    security announcements are published with a valid signature.

    To verify the signature of the announcement, save it as text into a file
    and run the command

      gpg --verify 

    replacing  with the name of the file where you saved the
    announcement. The output for a valid signature looks like:

      gpg: Signature made  using RSA key ID 3D25D3D9
      gpg: Good signature from "SuSE Security Team "

    where  is replaced by the date the document was signed.

    If the security team's key is not contained in your key ring, you can
    import it from the first installation CD. To import the key, use the
    command

      gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc

  - Package authenticity verification:

    SUSE update packages are available on many mirror FTP servers all over the
    world. While this service is considered valuable and important to the free
    and open source software community, the authenticity and the integrity of
    a package needs to be verified to ensure that it has not been tampered
    with.

    The internal rpm package signatures provide an easy way to verify the
    authenticity of an RPM package. Use the command

     rpm -v --checksig 

    to verify the signature of the package, replacing  with the
    filename of the RPM package downloaded. The package is unmodified if it
    contains a valid signature from build@suse.de with the key ID 9C800ACA.

    This key is automatically imported into the RPM database (on
    RPMv4-based distributions) and the gpg key ring of 'root' during
    installation. You can also find it on the first installation CD and at
    the end of this announcement.

  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    opensuse-security@opensuse.org
        -   General Linux and SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an e-mail to
                .

    opensuse-security-announce@opensuse.org
        -   SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an e-mail to
                .

    =====================================================================
    SUSE's security contact is  or .
    The  public key is listed below.
    =====================================================================
______________________________________________________________________________
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Report: U.S. planning “proportional response” to Sony hack, blamed on North Korea
Heartbleed, Shellshock, Tor and more: The 13 biggest security stories of 2014
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.