openSUSE Security Update : Mozilla Firefox / Thunderbird and NSS (openSUSE-2016-1407)

This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.


Synopsis :

The remote openSUSE host is missing a security update.

Description :

This update to Mozilla Firefox 50.0.2, Thunderbird 45.5.1 and NSS
3.16.2 fixes a number of security issues.

The following vulnerabilities were fixed in Mozilla Firefox (MFSA
2016-89) :

- CVE-2016-5296: Heap-buffer-overflow WRITE in
rasterize_edges_1 (bmo#1292443)

- CVE-2016-5292: URL parsing causes crash (bmo#1288482)

- CVE-2016-5297: Incorrect argument length checking in
JavaScript (bmo#1303678)

- CVE-2016-9064: Addons update must verify IDs match
between current and new versions (bmo#1303418)

- CVE-2016-9066: Integer overflow leading to a buffer
overflow in nsScriptLoadHandler (bmo#1299686)

- CVE-2016-9067: heap-use-after-free in
nsINode::ReplaceOrInsertBefore (bmo#1301777, bmo#1308922
(CVE-2016-9069))

- CVE-2016-9068: heap-use-after-free in nsRefreshDriver
(bmo#1302973)

- CVE-2016-9075: WebExtensions can access the
mozAddonManager API and use it to gain elevated
privileges (bmo#1295324)

- CVE-2016-9077: Canvas filters allow feDisplacementMaps
to be applied to cross-origin images, allowing timing
attacks on them (bmo#1298552)

- CVE-2016-5291: Same-origin policy violation using local
HTML file and saved shortcut file (bmo#1292159)

- CVE-2016-9070: Sidebar bookmark can have reference to
chrome window (bmo#1281071)

- CVE-2016-9073: windows.create schema doesn't specify
'format': 'relativeUrl' (bmo#1289273)

- CVE-2016-9076: select dropdown menu can be used for URL
bar spoofing on e10s (bmo#1276976)

- CVE-2016-9063: Possible integer overflow to fix inside
XML_Parse in expat (bmo#1274777)

- CVE-2016-9071: Probe browser history via HSTS/301
redirect + CSP (bmo#1285003)

- CVE-2016-5289: Memory safety bugs fixed in Firefox 50

- CVE-2016-5290: Memory safety bugs fixed in Firefox 50
and Firefox ESR 45.5

The following vulnerabilities were fixed in Mozilla NSS
3.26.1 :

- CVE-2016-9074: Insufficient timing side-channel
resistance in divSpoiler (bmo#1293334)

Mozilla Firefox now requires mozilla-nss 3.26.2.

New features in Mozilla Firefox :

- Updates to keyboard shortcuts Set a preference to have
Ctrl+Tab cycle through tabs in recently used order View
a page in Reader Mode by using Ctrl+Alt+R

- Added option to Find in page that allows users to limit
search to whole words only

- Added download protection for a large number of
executable file types on Windows, Mac and Linux

- Fixed rendering of dashed and dotted borders with
rounded corners (border-radius)

- Added a built-in Emoji set for operating systems without
native Emoji fonts

- Blocked versions of libavcodec older than 54.35.1

- additional locale

mozilla-nss was updated to 3.26.2, incorporating the
following changes :

- the selfserv test utility has been enhanced to support
ALPN (HTTP/1.1) and 0-RTT

- The following CA certificate was added: CN = ISRG Root
X1

- NPN is disabled and ALPN is enabled by default

- MD5 signature algorithms sent by the server in
CertificateRequest messages are now properly ignored

See also :

https://bugzilla.mozilla.org/show_bug.cgi?id=1227538
https://bugzilla.mozilla.org/show_bug.cgi?id=1245791
https://bugzilla.mozilla.org/show_bug.cgi?id=1245795
https://bugzilla.mozilla.org/show_bug.cgi?id=1246945
https://bugzilla.mozilla.org/show_bug.cgi?id=1246972
https://bugzilla.mozilla.org/show_bug.cgi?id=1247239
https://bugzilla.mozilla.org/show_bug.cgi?id=1274777
https://bugzilla.mozilla.org/show_bug.cgi?id=1276976
https://bugzilla.mozilla.org/show_bug.cgi?id=1281071
https://bugzilla.mozilla.org/show_bug.cgi?id=1285003
https://bugzilla.mozilla.org/show_bug.cgi?id=1288482
https://bugzilla.mozilla.org/show_bug.cgi?id=1289273
https://bugzilla.mozilla.org/show_bug.cgi?id=1292159
https://bugzilla.mozilla.org/show_bug.cgi?id=1292443
https://bugzilla.mozilla.org/show_bug.cgi?id=1293334
https://bugzilla.mozilla.org/show_bug.cgi?id=1294438
https://bugzilla.mozilla.org/show_bug.cgi?id=1295324
https://bugzilla.mozilla.org/show_bug.cgi?id=1298552
https://bugzilla.mozilla.org/show_bug.cgi?id=1299686
https://bugzilla.mozilla.org/show_bug.cgi?id=1300083
https://bugzilla.mozilla.org/show_bug.cgi?id=1301777
https://bugzilla.mozilla.org/show_bug.cgi?id=1302973
https://bugzilla.mozilla.org/show_bug.cgi?id=1303418
https://bugzilla.mozilla.org/show_bug.cgi?id=1303678
https://bugzilla.mozilla.org/show_bug.cgi?id=1306696
https://bugzilla.mozilla.org/show_bug.cgi?id=1308922
https://bugzilla.mozilla.org/show_bug.cgi?id=1317641
https://bugzilla.mozilla.org/show_bug.cgi?id=1321066
https://bugzilla.opensuse.org/show_bug.cgi?id=1009026
https://bugzilla.opensuse.org/show_bug.cgi?id=1010401
https://bugzilla.opensuse.org/show_bug.cgi?id=1010404
https://bugzilla.opensuse.org/show_bug.cgi?id=1010410
https://bugzilla.opensuse.org/show_bug.cgi?id=1010411
https://bugzilla.opensuse.org/show_bug.cgi?id=1010427
https://bugzilla.opensuse.org/show_bug.cgi?id=1012807
https://bugzilla.opensuse.org/show_bug.cgi?id=1012964

Solution :

Update the affected Mozilla Firefox / Thunderbird and NSS packages.

Risk factor :

High