[SUSE-SU-2015:0593-2] Security update for MozillaFirefox
Severity
Moderate
Affected Packages
12
CVEs
2
Security update for MozillaFirefox
MozillaFirefox was updated to the 31.5.3ESR release to fix two security
vulnerabilities:
*
MFSA 2015-29 / CVE-2015-0817: Security researcher ilxu1a reported,
through HP Zero Day Initiative's Pwn2Own contest, a flaw in Mozilla's
implementation of typed array bounds checking in JavaScript
just-in-time compilation (JIT) and its management of bounds checking
for heap access. This flaw can be leveraged into the reading and
writing of memory allowing for arbitrary code execution on the local
system.
*
MFSA 2015-28 / CVE-2015-0818: Security researcher Mariusz Mlynski
reported, through HP Zero Day Initiative's Pwn2Own contest, a method
to run arbitrary scripts in a privileged context. This bypassed the
same-origin policy protections by using a flaw in the processing of
SVG format content navigation.
Security Issues:
* CVE-2015-0817
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0817>
* CVE-2015-0818
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0818>
- ID
- SUSE-SU-2015:0593-2
- Severity
- moderate
- URL
- https://www.suse.com/support/update/announcement/2015/suse-su-20150593-2/
- Published
-
2015-03-23T23:58:05
(9 years ago) - Modified
-
2015-03-23T23:58:05
(9 years ago) - Rights
- Copyright 2024 SUSE LLC. All rights reserved.
- Other Advisories
Source | # ID | Name | URL |
---|---|---|---|
Suse | SUSE ratings | https://www.suse.com/support/security/rating/ | |
Suse | URL of this CSAF notice | https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0593-2.json | |
Suse | URL for SUSE-SU-2015:0593-2 | https://www.suse.com/support/update/announcement/2015/suse-su-20150593-2/ | |
Suse | E-Mail link for SUSE-SU-2015:0593-2 | https://lists.suse.com/pipermail/sle-security-updates/2015-March/001319.html | |
Bugzilla | SUSE Bug 923534 | https://bugzilla.suse.com/923534 | |
CVE | SUSE CVE CVE-2015-0817 page | https://www.suse.com/security/cve/CVE-2015-0817/ | |
CVE | SUSE CVE CVE-2015-0818 page | https://www.suse.com/security/cve/CVE-2015-0818/ |
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/suse/MozillaFirefox?arch=x86_64&distro=sles-11&sp=2 | suse | MozillaFirefox | < 31.5.3esr-0.3.1 | sles-11 | x86_64 | |
Affected | pkg:rpm/suse/MozillaFirefox?arch=x86_64&distro=sles-11&sp=1 | suse | MozillaFirefox | < 31.5.3esr-0.3.1 | sles-11 | x86_64 | |
Affected | pkg:rpm/suse/MozillaFirefox?arch=s390x&distro=sles-11&sp=2 | suse | MozillaFirefox | < 31.5.3esr-0.3.1 | sles-11 | s390x | |
Affected | pkg:rpm/suse/MozillaFirefox?arch=s390x&distro=sles-11&sp=1 | suse | MozillaFirefox | < 31.5.3esr-0.3.1 | sles-11 | s390x | |
Affected | pkg:rpm/suse/MozillaFirefox?arch=i586&distro=sles-11&sp=2 | suse | MozillaFirefox | < 31.5.3esr-0.3.1 | sles-11 | i586 | |
Affected | pkg:rpm/suse/MozillaFirefox?arch=i586&distro=sles-11&sp=1 | suse | MozillaFirefox | < 31.5.3esr-0.3.1 | sles-11 | i586 | |
Affected | pkg:rpm/suse/MozillaFirefox-translations?arch=x86_64&distro=sles-11&sp=2 | suse | MozillaFirefox-translations | < 31.5.3esr-0.3.1 | sles-11 | x86_64 | |
Affected | pkg:rpm/suse/MozillaFirefox-translations?arch=x86_64&distro=sles-11&sp=1 | suse | MozillaFirefox-translations | < 31.5.3esr-0.3.1 | sles-11 | x86_64 | |
Affected | pkg:rpm/suse/MozillaFirefox-translations?arch=s390x&distro=sles-11&sp=2 | suse | MozillaFirefox-translations | < 31.5.3esr-0.3.1 | sles-11 | s390x | |
Affected | pkg:rpm/suse/MozillaFirefox-translations?arch=s390x&distro=sles-11&sp=1 | suse | MozillaFirefox-translations | < 31.5.3esr-0.3.1 | sles-11 | s390x | |
Affected | pkg:rpm/suse/MozillaFirefox-translations?arch=i586&distro=sles-11&sp=2 | suse | MozillaFirefox-translations | < 31.5.3esr-0.3.1 | sles-11 | i586 | |
Affected | pkg:rpm/suse/MozillaFirefox-translations?arch=i586&distro=sles-11&sp=1 | suse | MozillaFirefox-translations | < 31.5.3esr-0.3.1 | sles-11 | i586 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |