File _patchinfo of Package patchinfo.2166

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.2166

<patchinfo incident="2166">
  <issue id="969894" tracker="bnc">VUL-0: MozillaFirefox 45 security release</issue>
  <issue id="CVE-2016-1962" tracker="cve" />
  <issue id="CVE-2016-1960" tracker="cve" />
  <issue id="CVE-2016-1961" tracker="cve" />
  <issue id="CVE-2016-2798" tracker="cve" />
  <issue id="CVE-2016-2799" tracker="cve" />
  <issue id="CVE-2016-1964" tracker="cve" />
  <issue id="CVE-2016-1965" tracker="cve" />
  <issue id="CVE-2016-2794" tracker="cve" />
  <issue id="CVE-2016-1966" tracker="cve" />
  <issue id="CVE-2016-2796" tracker="cve" />
  <issue id="CVE-2016-2797" tracker="cve" />
  <issue id="CVE-2016-2790" tracker="cve" />
  <issue id="CVE-2016-2791" tracker="cve" />
  <issue id="CVE-2016-2792" tracker="cve" />
  <issue id="CVE-2016-2793" tracker="cve" />
  <issue id="CVE-2016-2795" tracker="cve" />
  <issue id="CVE-2016-1958" tracker="cve" />
  <issue id="CVE-2016-1957" tracker="cve" />
  <issue id="CVE-2016-1954" tracker="cve" />
  <issue id="CVE-2016-1953" tracker="cve" />
  <issue id="CVE-2016-1952" tracker="cve" />
  <issue id="CVE-2016-1950" tracker="cve" />
  <issue id="CVE-2016-1974" tracker="cve" />
  <issue id="CVE-2016-1977" tracker="cve" />
  <issue id="CVE-2016-1979" tracker="cve" />
  <issue id="CVE-2016-1978" tracker="cve" />
  <issue id="CVE-2016-2800" tracker="cve" />
  <issue id="CVE-2016-2801" tracker="cve" />
  <issue id="CVE-2016-2802" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>pcerny</packager>
  <description>
This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues:

Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894), fixing
following security issues:
* MFSA 2016-16/CVE-2016-1952/CVE-2016-1953
  Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)
* MFSA 2016-17/CVE-2016-1954
  Local file overwriting and potential privilege escalation
  through CSP reports
* MFSA 2016-20/CVE-2016-1957
  Memory leak in libstagefright when deleting an array during
  MP4 processing
* MFSA 2016-21/CVE-2016-1958
  Displayed page address can be overridden
* MFSA 2016-23/CVE-2016-1960
  Use-after-free in HTML5 string parser
* MFSA 2016-24/CVE-2016-1961
  Use-after-free in SetBody
* MFSA 2016-25/CVE-2016-1962
  Use-after-free when using multiple WebRTC data channels
* MFSA 2016-27/CVE-2016-1964
  Use-after-free during XML transformations
* MFSA 2016-28/CVE-2016-1965
  Addressbar spoofing though history navigation and Location
  protocol property
* MFSA 2016-31/CVE-2016-1966
  Memory corruption with malicious NPAPI plugin
* MFSA 2016-34/CVE-2016-1974
  Out-of-bounds read in HTML parser following a failed
  allocation
* MFSA 2016-35/CVE-2016-1950
  Buffer overflow during ASN.1 decoding in NSS
* MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/
  CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/
  CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/
  CVE-2016-2800/CVE-2016-2801/CVE-2016-2802
  Font vulnerabilities in the Graphite 2 library

Mozilla NSPR was updated to version 4.12 (bsc#969894), fixing following bugs:
* added a PR_GetEnvSecure function, which attempts to detect if
  the program is being executed with elevated privileges, and
  returns NULL if detected. It is recommended to use this function
  in general purpose library code.
* fixed a memory allocation bug related to the PR_*printf functions
* exported API PR_DuplicateEnvironment, which had already been
  added in NSPR 4.10.9
* added support for FreeBSD aarch64
* several minor correctness and compatibility fixes

Mozilla NSS was updated to fix security issues (bsc#969894):
* MFSA 2016-15/CVE-2016-1978
  Use-after-free in NSS during SSL connections in low memory
* MFSA 2016-35/CVE-2016-1950
  Buffer overflow during ASN.1 decoding in NSS
* MFSA 2016-36/CVE-2016-1979
  Use-after-free during processing of DER encoded keys in NSS
</description>
  <summary>Security update for MozillaFirefox, mozilla-nspr, mozilla-nss</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.2166

Places