openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo (Revision b811f24d8b20d83e2c00289fca4ec685)

Currently displaying revision b811f24d8b20d83e2c00289fca4ec685 , Show latest

<patchinfo incident="6309">
  <issue id="1021837" tracker="bnc">VUL-0: CVE-2017-5393: MozillaFirefox: Remove addons.mozilla.org CDN from whitelist for mozAddonManager</issue>
  <issue id="1021835" tracker="bnc">VUL-0: CVE-2017-5391: MozillaFirefox: Content about: pages can load privileged about: pages</issue>
  <issue id="1021832" tracker="bnc">VUL-0: CVE-2017-5384: MozillaFirefox: Information disclosure via Proxy Auto-Config (PAC)</issue>
  <issue id="1021833" tracker="bnc">VUL-0: CVE-2017-5385: MozillaFirefox: Data sent in multipart channels ignores referrer-policy response headers</issue>
  <issue id="1021830" tracker="bnc">VUL-0: CVE-2017-5381: MozillaFirefox: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations</issue>
  <issue id="1021831" tracker="bnc">VUL-0: CVE-2017-5382: MozillaFirefox: Feed preview can expose privileged content errors and exceptions</issue>
  <issue id="1017174" tracker="bnc">firefox in english for a french installation</issue>
  <issue id="1021839" tracker="bnc">VUL-0: CVE-2017-5387: MozillaFirefox: Disclosure of local file existence through TRACK tag error messages</issue>
  <issue id="1021818" tracker="bnc">VUL-0: CVE-2017-5378: MozillaFirefox: Pointer and frame data leakage of Javascript objects</issue>
  <issue id="1021819" tracker="bnc">VUL-0: CVE-2017-5380: MozillaFirefox: Potential use-after-free during DOM manipulations</issue>
  <issue id="1021814" tracker="bnc">VUL-0: CVE-2017-5375: MozillaFirefox: Excessive JIT code allocation allows bypass of ASLR and DEP</issue>
  <issue id="1021817" tracker="bnc">VUL-0: CVE-2017-5376: MozillaFirefox: Use-after-free in XSL</issue>
  <issue id="1021841" tracker="bnc">VUL-0: CVE-2017-5374: MozillaFirefox: Memory safety bugs fixed in Firefox 51</issue>
  <issue id="1021840" tracker="bnc">VUL-0: CVE-2017-5388: MozillaFirefox: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks</issue>
  <issue id="1021828" tracker="bnc">VUL-0: CVE-2017-5389: MozillaFirefox: WebExtensions can install additional add-ons via modified host requests</issue>
  <issue id="1021821" tracker="bnc">VUL-0: CVE-2017-5396: MozillaFirefox: Use-after-free with Media Decoder</issue>
  <issue id="1021820" tracker="bnc">VUL-0: CVE-2017-5390: MozillaFirefox: Insecure communication methods in Developer Tools JSON viewer</issue>
  <issue id="1021823" tracker="bnc">VUL-0: CVE-2017-5386: MozillaFirefox: WebExtensions can use data: protocol to affect other extensions</issue>
  <issue id="1021822" tracker="bnc">VUL-0: CVE-2017-5383: MozillaFirefox: Location bar spoofing with unicode characters</issue>
  <issue id="1021824" tracker="bnc">VUL-0: CVE-2017-5373: MozillaFirefox: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7</issue>
  <issue id="1021827" tracker="bnc">VUL-0: CVE-2017-5379: MozillaFirefox: Use-after-free in Web Animations</issue>
  <issue id="1021826" tracker="bnc">VUL-0: CVE-2017-5377: MozillaFirefox: Memory corruption with transforms to create gradients in Skia</issue>
  <issue id="2017-5391" tracker="cve" />
  <issue id="2017-5390" tracker="cve" />
  <issue id="2017-5393" tracker="cve" />
  <issue id="2017-5392" tracker="cve" />
  <issue id="2017-5395" tracker="cve" />
  <issue id="2017-5394" tracker="cve" />
  <issue id="2017-5396" tracker="cve" />
  <issue id="2017-5388" tracker="cve" />
  <issue id="2017-5389" tracker="cve" />
  <issue id="2017-5382" tracker="cve" />
  <issue id="2017-5383" tracker="cve" />
  <issue id="2017-5380" tracker="cve" />
  <issue id="2017-5381" tracker="cve" />
  <issue id="2017-5386" tracker="cve" />
  <issue id="2017-5387" tracker="cve" />
  <issue id="2017-5384" tracker="cve" />
  <issue id="2017-5385" tracker="cve" />
  <issue id="2017-5373" tracker="cve" />
  <issue id="2017-5377" tracker="cve" />
  <issue id="2017-5376" tracker="cve" />
  <issue id="2017-5375" tracker="cve" />
  <issue id="2017-5374" tracker="cve" />
  <issue id="2017-5379" tracker="cve" />
  <issue id="2017-5378" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>wrosenauer</packager>
  <description>
This update for MozillaFirefox to version 51.0, mozilla-nspr to version 4.13.1 fixes the following issues:

These security issues were fixed:

* CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bmo#1325200, boo#1021814)
* CVE-2017-5376: Use-after-free in XSL (bmo#1311687, boo#1021817) CVE-2017-5377: Memory corruption with transforms to create gradients in Skia (bmo#1306883, boo#1021826)
* CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bmo#1312001, bmo#1330769, boo#1021818)
* CVE-2017-5379: Use-after-free in Web Animations (bmo#1309198,boo#1021827)
* CVE-2017-5380: Potential use-after-free during DOM manipulations (bmo#1322107, boo#1021819)
* CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bmo#1297361, boo#1021820)
* CVE-2017-5389: WebExtensions can install additional add-ons via modified host requests (bmo#1308688, boo#1021828)
* CVE-2017-5396: Use-after-free with Media Decoder (bmo#1329403, boo#1021821)
* CVE-2017-5381: Certificate Viewer exporting can be used to navigate and save to arbitrary filesystem locations (bmo#1017616, boo#1021830)
* CVE-2017-5382: Feed preview can expose privileged content errors and exceptions (bmo#1295322, boo#1021831)
* CVE-2017-5383: Location bar spoofing with unicode characters (bmo#1323338, bmo#1324716, boo#1021822)
* CVE-2017-5384: Information disclosure via Proxy Auto-Config (PAC) (bmo#1255474, boo#1021832)
* CVE-2017-5385: Data sent in multipart channels ignores referrer-policy response headers (bmo#1295945, boo#1021833)
* CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bmo#1319070, boo#1021823)
* CVE-2017-5391: Content about: pages can load privileged about: pages (bmo#1309310, boo#1021835)
* CVE-2017-5393: Remove addons.mozilla.org CDN from whitelist for mozAddonManager (bmo#1309282, boo#1021837)
* CVE-2017-5387: Disclosure of local file existence through TRACK tag error messages (bmo#1295023, boo#1021839)
* CVE-2017-5388: WebRTC can be used to generate a large amount of UDP traffic for DDOS attacks (bmo#1281482, boo#1021840)
* CVE-2017-5374: Memory safety bugs (boo#1021841)
* CVE-2017-5373: Memory safety bugs (boo#1021824)

These non-security issues in mozilla-nspr were fixed:

* PL_strcmp (and others) were fixed to return consistent results when one of the arguments is NULL.
* PollEvent was fixed to not block on clear.
* Pipes are always nonblocking.
* PR_GetNameForIdentity: added thread safety lock and bound checks.
* Removed the PLArena freelist.
* Avoid some integer overflows.
* fixed several comments.

These non-security issues in MozillaFirefox were fixed:

* Added support for FLAC (Free Lossless Audio Codec) playback
* Added support for WebGL 2
* Added Georgian (ka) and Kabyle (kab) locales
* Support saving passwords for forms without 'submit' events
* Improved video performance for users without GPU acceleration
* Zoom indicator is shown in the URL bar if the zoom level is not at default level
* View passwords from the prompt before saving them
* Remove Belarusian (be) locale
* Use Skia for content rendering (Linux)
* Improve recognition of LANGUAGE env variable (boo#1017174)
</description>
  <summary>Security update for MozillaFirefox, mozilla-nspr</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo (Revision b811f24d8b20d83e2c00289fca4ec685)

Places