File _patchinfo of Package patchinfo.4687

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.4687

<patchinfo incident="4687">
  <packager>wrosenauer</packager>
  <issue tracker="cve" id="2016-5289"></issue>
  <issue tracker="cve" id="2016-5290"></issue>
  <issue tracker="cve" id="2016-5291"></issue>
  <issue tracker="cve" id="2016-5292"></issue>
  <issue tracker="cve" id="2016-5293"></issue>
  <issue tracker="cve" id="2016-5294"></issue>
  <issue tracker="cve" id="2016-5295"></issue>
  <issue tracker="cve" id="2016-5296"></issue>
  <issue tracker="cve" id="2016-5297"></issue>
  <issue tracker="cve" id="2016-5298"></issue>
  <issue tracker="cve" id="2016-5299"></issue>
  <issue tracker="cve" id="2016-9061"></issue>
  <issue tracker="cve" id="2016-9062"></issue>
  <issue tracker="cve" id="2016-9063"></issue>
  <issue tracker="cve" id="2016-9064"></issue>
  <issue tracker="cve" id="2016-9065"></issue>
  <issue tracker="cve" id="2016-9066"></issue>
  <issue tracker="cve" id="2016-9067"></issue>
  <issue tracker="cve" id="2016-9068"></issue>
  <issue tracker="cve" id="2016-9069"></issue>
  <issue tracker="cve" id="2016-9070"></issue>
  <issue tracker="cve" id="2016-9071"></issue>
  <issue tracker="cve" id="2016-9072"></issue>
  <issue tracker="cve" id="2016-9073"></issue>
  <issue tracker="cve" id="2016-9074"></issue>
  <issue tracker="cve" id="2016-9075"></issue>
  <issue tracker="cve" id="2016-9076"></issue>
  <issue tracker="cve" id="2016-9077"></issue>
  <issue tracker="cve" id="2016-9078"></issue>
  <issue tracker="cve" id="2016-9079"></issue>
  <issue tracker="bmo" id="1227538"></issue>
  <issue tracker="bmo" id="1245791"></issue>
  <issue tracker="bmo" id="1245795"></issue>
  <issue tracker="bmo" id="1246945"></issue>
  <issue tracker="bmo" id="1246972"></issue>
  <issue tracker="bmo" id="1247239"></issue>
  <issue tracker="bmo" id="1274777"></issue>
  <issue tracker="bmo" id="1276976"></issue>
  <issue tracker="bmo" id="1281071"></issue>
  <issue tracker="bmo" id="1285003"></issue>
  <issue tracker="bmo" id="1288482"></issue>
  <issue tracker="bmo" id="1289273"></issue>
  <issue tracker="bmo" id="1292159"></issue>
  <issue tracker="bmo" id="1292443"></issue>
  <issue tracker="bmo" id="1293334"></issue>
  <issue tracker="bmo" id="1294438"></issue>
  <issue tracker="bmo" id="1295324"></issue>
  <issue tracker="bmo" id="1298552"></issue>
  <issue tracker="bmo" id="1299686"></issue>
  <issue tracker="bmo" id="1300083"></issue>
  <issue tracker="bmo" id="1301777"></issue>
  <issue tracker="bmo" id="1302973"></issue>
  <issue tracker="bmo" id="1303418"></issue>
  <issue tracker="bmo" id="1303678"></issue>
  <issue tracker="bmo" id="1306696"></issue>
  <issue tracker="bmo" id="1308922"></issue>
  <issue tracker="bmo" id="1317641"></issue>
  <issue tracker="bmo" id="1321066"></issue>
  <issue tracker="bnc" id="1009026">VUL-0: MozillaFirefox 50 / 45.5 ESR security release</issue>
  <issue tracker="bnc" id="1012807">VUL-0: CVE-2016-9078: MozillaFirefox: data: URL can inherit wrong origin after an HTTP redirect</issue>
  <issue tracker="bnc" id="1012964">VUL-0: CVE-2016-9079: MozillaFirefox,MozillaThunderbird: SVG Animation Remote Code Execution (MFSA 2016-92)</issue>
  <issue tracker="bnc" id="1010401">VUL-0: CVE-2016-5297: MozillaFirefox: Incorrect argument length checking in JavaScript</issue>
  <issue tracker="bnc" id="1010404">VUL-0: CVE-2016-9066: MozillaFirefox: Integer overflow leading to a buffer overflow in nsScriptLoadHandler</issue>
  <issue tracker="bnc" id="1010410">VUL-0: CVE-2016-5291: MozillaFirefox: Same-origin policy violation using local HTML file and saved shortcut file</issue>
  <issue tracker="bnc" id="1010411">VUL-0: CVE-2016-5295: MozillaFirefox: Ability to read arbitrary files as SYSTEM</issue>
  <issue tracker="bnc" id="1010427">VUL-0: CVE-2016-5290: MozillaFirefox: Memory safety bugs fixed in Firefox 50 and Firefox ESR 45.5</issue>
  <category>security</category>
  <rating>important</rating>
  <summary>Security update for Mozilla Firefox, Thunderbird and NSS</summary>
  <description>This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS 3.16.2 fixes a number of security issues.

The following vulnerabilities were fixed in Mozilla Firefox (MFSA 2016-89):

- CVE-2016-5296: Heap-buffer-overflow WRITE in rasterize_edges_1
     (bmo#1292443)
   - CVE-2016-5292: URL parsing causes crash (bmo#1288482)
   - CVE-2016-5297: Incorrect argument length checking in Javascript
     (bmo#1303678)
   - CVE-2016-9064: Addons update must verify IDs match between current and
     new versions (bmo#1303418)
   - CVE-2016-9066: Integer overflow leading to a buffer overflow in
     nsScriptLoadHandler (bmo#1299686)
   - CVE-2016-9067: heap-use-after-free in nsINode::ReplaceOrInsertBefore
     (bmo#1301777, bmo#1308922 (CVE-2016-9069))
   - CVE-2016-9068: heap-use-after-free in nsRefreshDriver (bmo#1302973)
   - CVE-2016-9075: WebExtensions can access the mozAddonManager API and use
     it to gain elevated privileges (bmo#1295324)
   - CVE-2016-9077: Canvas filters allow feDisplacementMaps to be applied to
     cross-origin images, allowing timing attacks on them (bmo#1298552)
   - CVE-2016-5291: Same-origin policy violation using local HTML file and
     saved shortcut file (bmo#1292159)
   - CVE-2016-9070: Sidebar bookmark can have reference to chrome window
     (bmo#1281071)
   - CVE-2016-9073: windows.create schema doesn't specify "format":
     "relativeUrl" (bmo#1289273)
   - CVE-2016-9076: select dropdown menu can be used for URL bar spoofing on
     e10s (bmo#1276976)
   - CVE-2016-9063: Possible integer overflow to fix inside XML_Parse in
     expat (bmo#1274777)
   - CVE-2016-9071: Probe browser history via HSTS/301 redirect + CSP
     (bmo#1285003)
   - CVE-2016-5289: Memory safety bugs fixed in Firefox 50
   - CVE-2016-5290: Memory safety bugs fixed in Firefox 50 and Firefox ESR
     45.5

The following vulnerabilities were fixed in Mozilla NSS 3.26.1:

- CVE-2016-9074: Insufficient timing side-channel resistance in divSpoiler
     (bmo#1293334)

Mozilla Firefox now requires mozilla-nss 3.26.2.

New features in Mozilla Firefox:

- Updates to keyboard shortcuts Set a preference to have Ctrl+Tab cycle
     through tabs in recently used order View a page in Reader Mode by using
     Ctrl+Alt+R
   - Added option to Find in page that allows users to limit search to whole
     words only
   - Added download protection for a large number of executable file types on
     Windows, Mac and Linux
   - Fixed rendering of dashed and dotted borders with rounded corners
     (border-radius)
   - Added a built-in Emoji set for operating systems without native Emoji
     fonts
   - Blocked versions of libavcodec older than 54.35.1
   - additional locale

mozilla-nss was updated to 3.26.2, incorporating the following changes:

- the selfserv test utility has been enhanced to support ALPN (HTTP/1.1)
     and 0-RTT
   - The following CA certificate was added: CN = ISRG Root X1
   - NPN is disabled and ALPN is enabled by default
   - MD5 signature algorithms sent by the server in CertificateRequest
     messages are now properly ignored</description>
</patchinfo>

Places

File _patchinfo of Package patchinfo.4687

Places