Jump to content
Compatible Support Forums
Sign in to follow this  
Followers 0
news

[security-announce] SUSE-SU-2015:1981-1: important: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss

By news, in Upcoming News

Recommended Posts

news    28

news
Posted

SUSE Security Update: Security update for MozillaFirefox, mozilla-nspr, mozilla-nss

______________________________________________________________________________

 

Announcement ID: SUSE-SU-2015:1981-1

Rating: important

References: #908275 #952810

Cross-References: CVE-2015-4513 CVE-2015-7181 CVE-2015-7182

CVE-2015-7183 CVE-2015-7188 CVE-2015-7189

CVE-2015-7193 CVE-2015-7194 CVE-2015-7196

CVE-2015-7197 CVE-2015-7198 CVE-2015-7199

CVE-2015-7200

Affected Products:

SUSE Linux Enterprise Software Development Kit 11-SP4

SUSE Linux Enterprise Software Development Kit 11-SP3

SUSE Linux Enterprise Server for VMWare 11-SP3

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Server 11-SP3

SUSE Linux Enterprise Desktop 11-SP4

SUSE Linux Enterprise Desktop 11-SP3

SUSE Linux Enterprise Debuginfo 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP3

______________________________________________________________________________

 

An update that fixes 13 vulnerabilities is now available.

 

Description:

 

 

This Mozilla Firefox, NSS and NSPR update fixes the following security and

non security issues.

 

- mozilla-nspr was updated to version 4.10.10 (bsc#952810)

* MFSA 2015-133/CVE-2015-7183 (bmo#1205157) NSPR memory corruption issues

 

- mozilla-nss was updated to 3.19.2.1 (bsc#952810)

* MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028, bmo#1202868)

NSS and NSPR memory corruption issues

 

- MozillaFirefox was updated to 38.4.0 ESR (bsc#952810)

* MFSA 2015-116/CVE-2015-4513 (bmo#1107011, bmo#1191942, bmo#1193038,

bmo#1204580, bmo#1204669, bmo#1204700, bmo#1205707, bmo#1206564,

bmo#1208665, bmo#1209471, bmo#1213979) Miscellaneous memory safety

hazards (rv:42.0 / rv:38.4)

* MFSA 2015-122/CVE-2015-7188 (bmo#1199430) Trailing whitespace in IP

address hostnames can bypass same-origin policy

* MFSA 2015-123/CVE-2015-7189 (bmo#1205900) Buffer overflow during image

interactions in canvas

* MFSA 2015-127/CVE-2015-7193 (bmo#1210302) CORS preflight is bypassed

when non-standard Content-Type headers are received

* MFSA 2015-128/CVE-2015-7194 (bmo#1211262) Memory corruption in libjar

through zip files

* MFSA 2015-130/CVE-2015-7196 (bmo#1140616) JavaScript garbage

collection crash with Java applet

* MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200 (bmo#1204061,

bmo#1188010, bmo#1204155) Vulnerabilities found through code inspection

* MFSA 2015-132/CVE-2015-7197 (bmo#1204269) Mixed content WebSocket

policy bypass through workers

* MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183 (bmo#1202868,

bmo#1192028, bmo#1205157) NSS and NSPR memory corruption issues

- fix printing on landscape media (bsc#908275)

 

 

Patch Instructions:

 

To install this SUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

 

- SUSE Linux Enterprise Software Development Kit 11-SP4:

 

zypper in -t patch sdksp4-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Software Development Kit 11-SP3:

 

zypper in -t patch sdksp3-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Server for VMWare 11-SP3:

 

zypper in -t patch slessp3-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Server 11-SP4:

 

zypper in -t patch slessp4-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Server 11-SP3:

 

zypper in -t patch slessp3-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Desktop 11-SP4:

 

zypper in -t patch sledsp4-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Desktop 11-SP3:

 

zypper in -t patch sledsp3-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Debuginfo 11-SP4:

 

zypper in -t patch dbgsp4-firefox-20151105-12205=1

 

- SUSE Linux Enterprise Debuginfo 11-SP3:

 

zypper in -t patch dbgsp3-firefox-20151105-12205=1

 

To bring your system up-to-date, use "zypper patch".

 

 

Package List:

 

- SUSE Linux Enterprise Software Development Kit 11-SP4 (i586 ia64 ppc64 s390x x86_64):

 

MozillaFirefox-devel-38.4.0esr-25.6

mozilla-nspr-devel-4.10.10-16.1

mozilla-nss-devel-3.19.2.1-19.3

 

- SUSE Linux Enterprise Software Development Kit 11-SP3 (i586 ia64 ppc64 s390x x86_64):

 

MozillaFirefox-devel-38.4.0esr-25.6

mozilla-nspr-devel-4.10.10-16.1

mozilla-nss-devel-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server for VMWare 11-SP3 (i586 x86_64):

 

MozillaFirefox-38.4.0esr-25.6

MozillaFirefox-branding-SLES-for-VMware-38-10.27

MozillaFirefox-translations-38.4.0esr-25.6

libfreebl3-3.19.2.1-19.3

libsoftokn3-3.19.2.1-19.3

mozilla-nspr-4.10.10-16.1

mozilla-nss-3.19.2.1-19.3

mozilla-nss-tools-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server for VMWare 11-SP3 (x86_64):

 

libfreebl3-32bit-3.19.2.1-19.3

libsoftokn3-32bit-3.19.2.1-19.3

mozilla-nspr-32bit-4.10.10-16.1

mozilla-nss-32bit-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):

 

MozillaFirefox-38.4.0esr-25.6

MozillaFirefox-branding-SLED-38-15.31

MozillaFirefox-translations-38.4.0esr-25.6

libfreebl3-3.19.2.1-19.3

libsoftokn3-3.19.2.1-19.3

mozilla-nspr-4.10.10-16.1

mozilla-nss-3.19.2.1-19.3

mozilla-nss-tools-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server 11-SP4 (ppc64 s390x x86_64):

 

libfreebl3-32bit-3.19.2.1-19.3

libsoftokn3-32bit-3.19.2.1-19.3

mozilla-nspr-32bit-4.10.10-16.1

mozilla-nss-32bit-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server 11-SP4 (ia64):

 

libfreebl3-x86-3.19.2.1-19.3

libsoftokn3-x86-3.19.2.1-19.3

mozilla-nspr-x86-4.10.10-16.1

mozilla-nss-x86-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server 11-SP3 (i586 ia64 ppc64 s390x x86_64):

 

MozillaFirefox-38.4.0esr-25.6

MozillaFirefox-branding-SLED-38-15.31

MozillaFirefox-translations-38.4.0esr-25.6

libfreebl3-3.19.2.1-19.3

libsoftokn3-3.19.2.1-19.3

mozilla-nspr-4.10.10-16.1

mozilla-nss-3.19.2.1-19.3

mozilla-nss-tools-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server 11-SP3 (ppc64 s390x x86_64):

 

libfreebl3-32bit-3.19.2.1-19.3

libsoftokn3-32bit-3.19.2.1-19.3

mozilla-nspr-32bit-4.10.10-16.1

mozilla-nss-32bit-3.19.2.1-19.3

 

- SUSE Linux Enterprise Server 11-SP3 (ia64):

 

libfreebl3-x86-3.19.2.1-19.3

libsoftokn3-x86-3.19.2.1-19.3

mozilla-nspr-x86-4.10.10-16.1

mozilla-nss-x86-3.19.2.1-19.3

 

- SUSE Linux Enterprise Desktop 11-SP4 (i586 x86_64):

 

MozillaFirefox-38.4.0esr-25.6

MozillaFirefox-branding-SLED-38-15.31

MozillaFirefox-translations-38.4.0esr-25.6

libfreebl3-3.19.2.1-19.3

libsoftokn3-3.19.2.1-19.3

mozilla-nspr-4.10.10-16.1

mozilla-nss-3.19.2.1-19.3

mozilla-nss-tools-3.19.2.1-19.3

 

- SUSE Linux Enterprise Desktop 11-SP4 (x86_64):

 

libfreebl3-32bit-3.19.2.1-19.3

libsoftokn3-32bit-3.19.2.1-19.3

mozilla-nspr-32bit-4.10.10-16.1

mozilla-nss-32bit-3.19.2.1-19.3

 

- SUSE Linux Enterprise Desktop 11-SP3 (i586 x86_64):

 

MozillaFirefox-38.4.0esr-25.6

MozillaFirefox-branding-SLED-38-15.31

MozillaFirefox-translations-38.4.0esr-25.6

libfreebl3-3.19.2.1-19.3

libsoftokn3-3.19.2.1-19.3

mozilla-nspr-4.10.10-16.1

mozilla-nss-3.19.2.1-19.3

mozilla-nss-tools-3.19.2.1-19.3

 

- SUSE Linux Enterprise Desktop 11-SP3 (x86_64):

 

libfreebl3-32bit-3.19.2.1-19.3

libsoftokn3-32bit-3.19.2.1-19.3

mozilla-nspr-32bit-4.10.10-16.1

mozilla-nss-32bit-3.19.2.1-19.3

 

- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):

 

MozillaFirefox-debuginfo-38.4.0esr-25.6

MozillaFirefox-debugsource-38.4.0esr-25.6

mozilla-nspr-debuginfo-4.10.10-16.1

mozilla-nspr-debugsource-4.10.10-16.1

mozilla-nss-debuginfo-3.19.2.1-19.3

mozilla-nss-debugsource-3.19.2.1-19.3

 

- SUSE Linux Enterprise Debuginfo 11-SP4 (ppc64 s390x x86_64):

 

mozilla-nspr-debuginfo-32bit-4.10.10-16.1

 

- SUSE Linux Enterprise Debuginfo 11-SP4 (ia64):

 

mozilla-nspr-debuginfo-x86-4.10.10-16.1

 

- SUSE Linux Enterprise Debuginfo 11-SP3 (i586 ia64 ppc64 s390x x86_64):

 

MozillaFirefox-debuginfo-38.4.0esr-25.6

MozillaFirefox-debugsource-38.4.0esr-25.6

mozilla-nspr-debuginfo-4.10.10-16.1

mozilla-nspr-debugsource-4.10.10-16.1

mozilla-nss-debuginfo-3.19.2.1-19.3

mozilla-nss-debugsource-3.19.2.1-19.3

 

- SUSE Linux Enterprise Debuginfo 11-SP3 (ppc64 s390x x86_64):

 

mozilla-nspr-debuginfo-32bit-4.10.10-16.1

 

- SUSE Linux Enterprise Debuginfo 11-SP3 (ia64):

 

mozilla-nspr-debuginfo-x86-4.10.10-16.1

 

 

References:

 

https://www.suse.com/security/cve/CVE-2015-4513.html

https://www.suse.com/security/cve/CVE-2015-7181.html

https://www.suse.com/security/cve/CVE-2015-7182.html

https://www.suse.com/security/cve/CVE-2015-7183.html

https://www.suse.com/security/cve/CVE-2015-7188.html

https://www.suse.com/security/cve/CVE-2015-7189.html

https://www.suse.com/security/cve/CVE-2015-7193.html

https://www.suse.com/security/cve/CVE-2015-7194.html

https://www.suse.com/security/cve/CVE-2015-7196.html

https://www.suse.com/security/cve/CVE-2015-7197.html

https://www.suse.com/security/cve/CVE-2015-7198.html

https://www.suse.com/security/cve/CVE-2015-7199.html

https://www.suse.com/security/cve/CVE-2015-7200.html

https://bugzilla.suse.com/908275

https://bugzilla.suse.com/952810

 

--

To unsubscribe, e-mail: opensuse-security-announce+unsubscribe ( -at -) opensuse.org

For additional commands, e-mail: opensuse-security-announce+help ( -at -) opensuse.org

 

 

 

Share this post

Link to post

Please sign in to comment

You will be able to leave a comment after signing in



Sign In Now
Sign in to follow this  
Followers 0
Go To Topic Listing Upcoming News
×