1. Home
  2. Security Advisories
  3. SUSE
  4. SUSE-SU-2016:0909-1

[SUSE-SU-2016:0909-1] Security update for MozillaFirefox, mozilla-nspr, mozilla-nss

Severity Important
Affected Packages 30
CVEs 29
Info Packages References Vulnerabilities

Security update for MozillaFirefox, mozilla-nspr, mozilla-nss

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:

Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894), fixing
following security issues:
* MFSA 2016-16/CVE-2016-1952/CVE-2016-1953
Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)
* MFSA 2016-17/CVE-2016-1954
Local file overwriting and potential privilege escalation
through CSP reports
* MFSA 2016-20/CVE-2016-1957
Memory leak in libstagefright when deleting an array during
MP4 processing
* MFSA 2016-21/CVE-2016-1958
Displayed page address can be overridden
* MFSA 2016-23/CVE-2016-1960
Use-after-free in HTML5 string parser
* MFSA 2016-24/CVE-2016-1961
Use-after-free in SetBody
* MFSA 2016-25/CVE-2016-1962
Use-after-free when using multiple WebRTC data channels
* MFSA 2016-27/CVE-2016-1964
Use-after-free during XML transformations
* MFSA 2016-28/CVE-2016-1965
Addressbar spoofing though history navigation and Location
protocol property
* MFSA 2016-31/CVE-2016-1966
Memory corruption with malicious NPAPI plugin
* MFSA 2016-34/CVE-2016-1974
Out-of-bounds read in HTML parser following a failed
allocation
* MFSA 2016-35/CVE-2016-1950
Buffer overflow during ASN.1 decoding in NSS
* MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/
CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/
CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/
CVE-2016-2800/CVE-2016-2801/CVE-2016-2802
Font vulnerabilities in the Graphite 2 library

Mozilla NSPR was updated to version 4.12 (bsc#969894), fixing following bugs:
* added a PR_GetEnvSecure function, which attempts to detect if
the program is being executed with elevated privileges, and
returns NULL if detected. It is recommended to use this function
in general purpose library code.
* fixed a memory allocation bug related to the PR_*printf functions
* exported API PR_DuplicateEnvironment, which had already been
added in NSPR 4.10.9
* added support for FreeBSD aarch64
* several minor correctness and compatibility fixes

Mozilla NSS was updated to fix security issues (bsc#969894):
* MFSA 2016-15/CVE-2016-1978
Use-after-free in NSS during SSL connections in low memory
* MFSA 2016-35/CVE-2016-1950
Buffer overflow during ASN.1 decoding in NSS
* MFSA 2016-36/CVE-2016-1979
Use-after-free during processing of DER encoded keys in NSS

Package Affected Version
pkg:rpm/suse/MozillaFirefox?arch=x86_64&distro=sles-11&sp=2 < 38.7.0esr-36.3
pkg:rpm/suse/MozillaFirefox?arch=s390x&distro=sles-11&sp=2 < 38.7.0esr-36.3
pkg:rpm/suse/MozillaFirefox?arch=i586&distro=sles-11&sp=2 < 38.7.0esr-36.3
pkg:rpm/suse/MozillaFirefox-translations?arch=x86_64&distro=sles-11&sp=2 < 38.7.0esr-36.3
pkg:rpm/suse/MozillaFirefox-translations?arch=s390x&distro=sles-11&sp=2 < 38.7.0esr-36.3
pkg:rpm/suse/MozillaFirefox-translations?arch=i586&distro=sles-11&sp=2 < 38.7.0esr-36.3
pkg:rpm/suse/mozilla-nss?arch=x86_64&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss?arch=s390x&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss?arch=i586&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-tools?arch=x86_64&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-tools?arch=s390x&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-tools?arch=i586&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-devel?arch=x86_64&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-devel?arch=s390x&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-devel?arch=i586&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-32bit?arch=x86_64&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nss-32bit?arch=s390x&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/mozilla-nspr?arch=x86_64&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr?arch=s390x&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr?arch=i586&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr-devel?arch=x86_64&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr-devel?arch=s390x&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr-devel?arch=i586&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr-32bit?arch=x86_64&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/mozilla-nspr-32bit?arch=s390x&distro=sles-11&sp=2 < 4.12-19.1
pkg:rpm/suse/libfreebl3?arch=x86_64&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/libfreebl3?arch=s390x&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/libfreebl3?arch=i586&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/libfreebl3-32bit?arch=x86_64&distro=sles-11&sp=2 < 3.20.2-20.1
pkg:rpm/suse/libfreebl3-32bit?arch=s390x&distro=sles-11&sp=2 < 3.20.2-20.1
ID
SUSE-SU-2016:0909-1
Severity
important
URL
https://www.suse.com/support/update/announcement/2016/suse-su-20160909-1/
Published
2016-03-30T10:06:02
(8 years ago)
Modified
2016-03-30T10:06:02
(8 years ago)
Rights
Copyright 2024 SUSE LLC. All rights reserved.
Other Advisories
Source # ID Name URL
Suse SUSE ratings https://www.suse.com/support/security/rating/
Suse URL of this CSAF notice https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_0909-1.json
Suse URL for SUSE-SU-2016:0909-1 https://www.suse.com/support/update/announcement/2016/suse-su-20160909-1/
Suse E-Mail link for SUSE-SU-2016:0909-1 https://lists.suse.com/pipermail/sle-security-updates/2016-March/001971.html
Bugzilla SUSE Bug 969894 https://bugzilla.suse.com/969894
CVE SUSE CVE CVE-2016-1950 page https://www.suse.com/security/cve/CVE-2016-1950/
CVE SUSE CVE CVE-2016-1952 page https://www.suse.com/security/cve/CVE-2016-1952/
CVE SUSE CVE CVE-2016-1953 page https://www.suse.com/security/cve/CVE-2016-1953/
CVE SUSE CVE CVE-2016-1954 page https://www.suse.com/security/cve/CVE-2016-1954/
CVE SUSE CVE CVE-2016-1957 page https://www.suse.com/security/cve/CVE-2016-1957/
CVE SUSE CVE CVE-2016-1958 page https://www.suse.com/security/cve/CVE-2016-1958/
CVE SUSE CVE CVE-2016-1960 page https://www.suse.com/security/cve/CVE-2016-1960/
CVE SUSE CVE CVE-2016-1961 page https://www.suse.com/security/cve/CVE-2016-1961/
CVE SUSE CVE CVE-2016-1962 page https://www.suse.com/security/cve/CVE-2016-1962/
CVE SUSE CVE CVE-2016-1964 page https://www.suse.com/security/cve/CVE-2016-1964/
CVE SUSE CVE CVE-2016-1965 page https://www.suse.com/security/cve/CVE-2016-1965/
CVE SUSE CVE CVE-2016-1966 page https://www.suse.com/security/cve/CVE-2016-1966/
CVE SUSE CVE CVE-2016-1974 page https://www.suse.com/security/cve/CVE-2016-1974/
CVE SUSE CVE CVE-2016-1977 page https://www.suse.com/security/cve/CVE-2016-1977/
CVE SUSE CVE CVE-2016-1978 page https://www.suse.com/security/cve/CVE-2016-1978/
CVE SUSE CVE CVE-2016-1979 page https://www.suse.com/security/cve/CVE-2016-1979/
CVE SUSE CVE CVE-2016-2790 page https://www.suse.com/security/cve/CVE-2016-2790/
CVE SUSE CVE CVE-2016-2791 page https://www.suse.com/security/cve/CVE-2016-2791/
CVE SUSE CVE CVE-2016-2792 page https://www.suse.com/security/cve/CVE-2016-2792/
CVE SUSE CVE CVE-2016-2793 page https://www.suse.com/security/cve/CVE-2016-2793/
CVE SUSE CVE CVE-2016-2794 page https://www.suse.com/security/cve/CVE-2016-2794/
CVE SUSE CVE CVE-2016-2795 page https://www.suse.com/security/cve/CVE-2016-2795/
CVE SUSE CVE CVE-2016-2796 page https://www.suse.com/security/cve/CVE-2016-2796/
CVE SUSE CVE CVE-2016-2797 page https://www.suse.com/security/cve/CVE-2016-2797/
CVE SUSE CVE CVE-2016-2798 page https://www.suse.com/security/cve/CVE-2016-2798/
CVE SUSE CVE CVE-2016-2799 page https://www.suse.com/security/cve/CVE-2016-2799/
CVE SUSE CVE CVE-2016-2800 page https://www.suse.com/security/cve/CVE-2016-2800/
CVE SUSE CVE CVE-2016-2801 page https://www.suse.com/security/cve/CVE-2016-2801/
CVE SUSE CVE CVE-2016-2802 page https://www.suse.com/security/cve/CVE-2016-2802/
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/suse/MozillaFirefox?arch=x86_64&distro=sles-11&sp=2 suse MozillaFirefox < 38.7.0esr-36.3 sles-11 x86_64
Affected pkg:rpm/suse/MozillaFirefox?arch=s390x&distro=sles-11&sp=2 suse MozillaFirefox < 38.7.0esr-36.3 sles-11 s390x
Affected pkg:rpm/suse/MozillaFirefox?arch=i586&distro=sles-11&sp=2 suse MozillaFirefox < 38.7.0esr-36.3 sles-11 i586
Affected pkg:rpm/suse/MozillaFirefox-translations?arch=x86_64&distro=sles-11&sp=2 suse MozillaFirefox-translations < 38.7.0esr-36.3 sles-11 x86_64
Affected pkg:rpm/suse/MozillaFirefox-translations?arch=s390x&distro=sles-11&sp=2 suse MozillaFirefox-translations < 38.7.0esr-36.3 sles-11 s390x
Affected pkg:rpm/suse/MozillaFirefox-translations?arch=i586&distro=sles-11&sp=2 suse MozillaFirefox-translations < 38.7.0esr-36.3 sles-11 i586
Affected pkg:rpm/suse/mozilla-nss?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nss < 3.20.2-20.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nss?arch=s390x&distro=sles-11&sp=2 suse mozilla-nss < 3.20.2-20.1 sles-11 s390x
Affected pkg:rpm/suse/mozilla-nss?arch=i586&distro=sles-11&sp=2 suse mozilla-nss < 3.20.2-20.1 sles-11 i586
Affected pkg:rpm/suse/mozilla-nss-tools?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nss-tools < 3.20.2-20.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nss-tools?arch=s390x&distro=sles-11&sp=2 suse mozilla-nss-tools < 3.20.2-20.1 sles-11 s390x
Affected pkg:rpm/suse/mozilla-nss-tools?arch=i586&distro=sles-11&sp=2 suse mozilla-nss-tools < 3.20.2-20.1 sles-11 i586
Affected pkg:rpm/suse/mozilla-nss-devel?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nss-devel < 3.20.2-20.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nss-devel?arch=s390x&distro=sles-11&sp=2 suse mozilla-nss-devel < 3.20.2-20.1 sles-11 s390x
Affected pkg:rpm/suse/mozilla-nss-devel?arch=i586&distro=sles-11&sp=2 suse mozilla-nss-devel < 3.20.2-20.1 sles-11 i586
Affected pkg:rpm/suse/mozilla-nss-32bit?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nss-32bit < 3.20.2-20.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nss-32bit?arch=s390x&distro=sles-11&sp=2 suse mozilla-nss-32bit < 3.20.2-20.1 sles-11 s390x
Affected pkg:rpm/suse/mozilla-nspr?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nspr < 4.12-19.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nspr?arch=s390x&distro=sles-11&sp=2 suse mozilla-nspr < 4.12-19.1 sles-11 s390x
Affected pkg:rpm/suse/mozilla-nspr?arch=i586&distro=sles-11&sp=2 suse mozilla-nspr < 4.12-19.1 sles-11 i586
Affected pkg:rpm/suse/mozilla-nspr-devel?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nspr-devel < 4.12-19.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nspr-devel?arch=s390x&distro=sles-11&sp=2 suse mozilla-nspr-devel < 4.12-19.1 sles-11 s390x
Affected pkg:rpm/suse/mozilla-nspr-devel?arch=i586&distro=sles-11&sp=2 suse mozilla-nspr-devel < 4.12-19.1 sles-11 i586
Affected pkg:rpm/suse/mozilla-nspr-32bit?arch=x86_64&distro=sles-11&sp=2 suse mozilla-nspr-32bit < 4.12-19.1 sles-11 x86_64
Affected pkg:rpm/suse/mozilla-nspr-32bit?arch=s390x&distro=sles-11&sp=2 suse mozilla-nspr-32bit < 4.12-19.1 sles-11 s390x
Affected pkg:rpm/suse/libfreebl3?arch=x86_64&distro=sles-11&sp=2 suse libfreebl3 < 3.20.2-20.1 sles-11 x86_64
Affected pkg:rpm/suse/libfreebl3?arch=s390x&distro=sles-11&sp=2 suse libfreebl3 < 3.20.2-20.1 sles-11 s390x
Affected pkg:rpm/suse/libfreebl3?arch=i586&distro=sles-11&sp=2 suse libfreebl3 < 3.20.2-20.1 sles-11 i586
Affected pkg:rpm/suse/libfreebl3-32bit?arch=x86_64&distro=sles-11&sp=2 suse libfreebl3-32bit < 3.20.2-20.1 sles-11 x86_64
Affected pkg:rpm/suse/libfreebl3-32bit?arch=s390x&distro=sles-11&sp=2 suse libfreebl3-32bit < 3.20.2-20.1 sles-11 s390x
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date