New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 6.7
SynopsisThe remote openSUSE host is missing a security update.
DescriptionThe Mozilla Firefox web browser was updated to version 38.0.1 to fix several security and non-security issues. This update also includes a Mozilla Network Security Services (NSS) update to version 3.18.1.
The following vulnerabilities and issues were fixed :
Changes in Mozilla Firefox :
- update to Firefox 38.0.1 stability and regression fixes
- Systems with first generation NVidia Optimus graphics cards may crash on start-up
- Users who import cookies from Google Chrome can end up with broken websites
- Large animated images may fail to play and may stop other images from loading
- update to Firefox 38.0 (bnc#930622)
- New tab-based preferences
- Ruby annotation support
- more info:
https://www.mozilla.org/en-US/firefox/38.0/releasenotes/ security fixes :
- MFSA 2015-46/CVE-2015-2708/CVE-2015-2709 Miscellaneous memory safety hazards
- MFSA 2015-47/VE-2015-0797 (bmo#1080995) Buffer overflow parsing H.264 video with Linux Gstreamer
- MFSA 2015-48/CVE-2015-2710 (bmo#1149542) Buffer overflow with SVG content and CSS
- MFSA 2015-49/CVE-2015-2711 (bmo#1113431) Referrer policy ignored when links opened by middle-click and context menu
- MFSA 2015-50/CVE-2015-2712 (bmo#1152280) Out-of-bounds read and write in asm.js validation
- MFSA 2015-51/CVE-2015-2713 (bmo#1153478) Use-after-free during text processing with vertical text enabled
- MFSA 2015-53/CVE-2015-2715 (bmo#988698) Use-after-free due to Media Decoder Thread creation during shutdown
- MFSA 2015-54/CVE-2015-2716 (bmo#1140537) Buffer overflow when parsing compressed XML
- MFSA 2015-55/CVE-2015-2717 (bmo#1154683) Buffer overflow and out-of-bounds read while parsing MP4 video metadata
- MFSA 2015-56/CVE-2015-2718 (bmo#1146724) Untrusted site hosting trusted page can intercept webchannel responses
- MFSA 2015-57/CVE-2011-3079 (bmo#1087565) Privilege escalation through IPC channel messages
Changes in Mozilla NSS :
- update to 3.18.1
- Firefox target release 38
- No new functionality is introduced in this release.
Notable Changes :
- The following CA certificate had the Websites and Code Signing trust bits restored to their original state to allow more time to develop a better transition strategy for affected sites :
- OU = Equifax Secure Certificate Authority
- The following CA certificate was removed :
- CN = e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi
- The following intermediate CA certificate has been added as actively distrusted because it was mis-used to issue certificates for domain names the holder did not own or control :
- CN=MCSHOLDING TEST, O=MCSHOLDING, C=EG
- The version number of the updated root CA list has been set to 2.4
- update to 3.18
- Firefox target release 38 New functionality :
- When importing certificates and keys from a PKCS#12 source, it's now possible to override the nicknames, prior to importing them into the NSS database, using new API SEC_PKCS12DecoderRenameCertNicknames.
- The tstclnt test utility program has new command-line options
-C, -D, -b and -R. Use -C one, two or three times to print information about the certificates received from a server, and information about the locally found and trusted issuer certificates, to diagnose server side configuration issues. It is possible to run tstclnt
SolutionUpdate the affected MozillaFirefox packages.