openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2016:3310-1
Rating:             important
References:         #1011922 #1015422 
Cross-References:   CVE-2016-9080 CVE-2016-9893 CVE-2016-9894
                    CVE-2016-9895 CVE-2016-9896 CVE-2016-9897
                    CVE-2016-9898 CVE-2016-9899 CVE-2016-9900
                    CVE-2016-9901 CVE-2016-9902 CVE-2016-9903
                    CVE-2016-9904
Affected Products:
                    openSUSE 13.1
______________________________________________________________________________

   An update that fixes 13 vulnerabilities is now available.

Description:

      This update to MozillaFirefox 50.1.0 fixes the following
   vulnerabilities:

      - CVE-2016-9894: Buffer overflow in SkiaGL
      - CVE-2016-9899: Use-after-free while manipulating DOM events and audio
        elements
      - CVE-2016-9895: CSP bypass using marquee tag
      - CVE-2016-9896: Use-after-free with WebVR
      - CVE-2016-9897: Memory corruption in libGLES
      - CVE-2016-9898: Use-after-free in Editor while manipulating DOM
        subtrees
      - CVE-2016-9900: Restricted external resources can be loaded by SVG
        images through data URLs
      - CVE-2016-9904: Cross-origin information leak in shared atoms
      - CVE-2016-9901: Data from Pocket server improperly sanitized before
        execution
      - CVE-2016-9902: Pocket extension does not validate the origin of events
      - CVE-2016-9903: XSS injection vulnerability in add-ons SDK
      - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1
      - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox
        ESR 45.6

      The following bugs were fixed:

      - boo#1011922: fix crash after a few seconds of usage on AArch64


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 13.1:

      zypper in -t patch 2016-1534=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 13.1 (i586 x86_64):

      MozillaFirefox-50.1.0-134.1
      MozillaFirefox-branding-upstream-50.1.0-134.1
      MozillaFirefox-buildsymbols-50.1.0-134.1
      MozillaFirefox-debuginfo-50.1.0-134.1
      MozillaFirefox-debugsource-50.1.0-134.1
      MozillaFirefox-devel-50.1.0-134.1
      MozillaFirefox-translations-common-50.1.0-134.1
      MozillaFirefox-translations-other-50.1.0-134.1


References:

   https://www.suse.com/security/cve/CVE-2016-9080.html
   https://www.suse.com/security/cve/CVE-2016-9893.html
   https://www.suse.com/security/cve/CVE-2016-9894.html
   https://www.suse.com/security/cve/CVE-2016-9895.html
   https://www.suse.com/security/cve/CVE-2016-9896.html
   https://www.suse.com/security/cve/CVE-2016-9897.html
   https://www.suse.com/security/cve/CVE-2016-9898.html
   https://www.suse.com/security/cve/CVE-2016-9899.html
   https://www.suse.com/security/cve/CVE-2016-9900.html
   https://www.suse.com/security/cve/CVE-2016-9901.html
   https://www.suse.com/security/cve/CVE-2016-9902.html
   https://www.suse.com/security/cve/CVE-2016-9903.html
   https://www.suse.com/security/cve/CVE-2016-9904.html
   https://bugzilla.suse.com/1011922
   https://bugzilla.suse.com/1015422

openSUSE: 2016:3310-1: important: MozillaFirefox

December 31, 2016
An update that fixes 13 vulnerabilities is now available

Description

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities: - CVE-2016-9894: Buffer overflow in SkiaGL - CVE-2016-9899: Use-after-free while manipulating DOM events and audio elements - CVE-2016-9895: CSP bypass using marquee tag - CVE-2016-9896: Use-after-free with WebVR - CVE-2016-9897: Memory corruption in libGLES - CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees - CVE-2016-9900: Restricted external resources can be loaded by SVG images through data URLs - CVE-2016-9904: Cross-origin information leak in shared atoms - CVE-2016-9901: Data from Pocket server improperly sanitized before execution - CVE-2016-9902: Pocket extension does not validate the origin of events - CVE-2016-9903: XSS injection vulnerability in add-ons SDK - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1 - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR 45.6 The following bugs were fixed: - boo#1011922: fix crash after a few seconds of usage on AArch64

 

Patch

Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch 2016-1534=1 To bring your system up-to-date, use "zypper patch".


Package List

- openSUSE 13.1 (i586 x86_64): MozillaFirefox-50.1.0-134.1 MozillaFirefox-branding-upstream-50.1.0-134.1 MozillaFirefox-buildsymbols-50.1.0-134.1 MozillaFirefox-debuginfo-50.1.0-134.1 MozillaFirefox-debugsource-50.1.0-134.1 MozillaFirefox-devel-50.1.0-134.1 MozillaFirefox-translations-common-50.1.0-134.1 MozillaFirefox-translations-other-50.1.0-134.1


References

https://www.suse.com/security/cve/CVE-2016-9080.html https://www.suse.com/security/cve/CVE-2016-9893.html https://www.suse.com/security/cve/CVE-2016-9894.html https://www.suse.com/security/cve/CVE-2016-9895.html https://www.suse.com/security/cve/CVE-2016-9896.html https://www.suse.com/security/cve/CVE-2016-9897.html https://www.suse.com/security/cve/CVE-2016-9898.html https://www.suse.com/security/cve/CVE-2016-9899.html https://www.suse.com/security/cve/CVE-2016-9900.html https://www.suse.com/security/cve/CVE-2016-9901.html https://www.suse.com/security/cve/CVE-2016-9902.html https://www.suse.com/security/cve/CVE-2016-9903.html https://www.suse.com/security/cve/CVE-2016-9904.html https://bugzilla.suse.com/1011922 https://bugzilla.suse.com/1015422


Severity
Announcement ID: openSUSE-SU-2016:3310-1
Rating: important
Affected Products: openSUSE 13.1 .

Related News

11.Locks IsometricPattern Esm H320
2 - 3 min read
The Kinsing hacker group, or H2Miner, has been orchestrating illicit cryptocurrency mining campaigns since 2019 and poses a persistent security
32.Lock Code Circular Esm H320
2 - 3 min read
The Kimsuky APT group, reportedly linked to North Korea's Reconnaissance General Bureau (RGB), has been identified deploying a Linux version of its
4.Lock AbstractDigital Esm H320
2 - 3 min read
Recent research sheds light on the security vulnerabilities prevalent in Linux vendor kernels due to flawed engineering processes that backport
28.Lock Globe Esm H320
1 - 2 min read
The intersection of Linux and quantum computing has become increasingly apparent, emphasizing the importance of Linux-based operating systems in
6.EmailConnection Touch Esm H320
2 - 3 min read
Recent security updates for Ubuntu and Debian have been released to address vulnerabilities in Thunderbird, the popular open-source mail and
30.Lock Globe Motherboard Esm H320
1 - 2 min read
As cybersecurity practitioners, we are no strangers to the constant threat of malicious actors and the importance of remaining vigilant to protect
22.Lock ScreenEffect Esm H320
1 - 2 min read
EndeavorOS Gemini is a captivating and charming desktop operating system based on Arch Linux. The new release includes a kernel upgrade, 3D graphics
25.@Sign Hook Keyboard Esm H320
1 min read
Cyber risk is increasing for individuals and organizations, making flexible and robust solutions for identifying spam and malware increasingly

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved