38.6.0 的此更新修复了以下问题：

- MFSA 2016-01/CVE-2016-1930 多项内存安全危害

- MFSA 2016-03/CVE-2016-1935 (bmo#1220450) 内存不足分配后在 WebGL 中发生缓冲区溢出

此 MozillaFirefox、MozillaFirefox-branding-SLE、mozilla-nss 更新可修复以下问题：(bsc#963520)

Mozilla Firefox 已更新到 38.6.0 ESR。Mozilla NSS 已更新到 3.20.2。

修复了以下漏洞：

- CVE-2016-1930：内存安全缺陷已在 Firefox ESR 38.6 中修复 (bsc#963632)

- CVE-2016-1935：内存不足分配后在 WebGL 中发生缓冲区溢出 (bsc#963635)

- CVE-2016-1938：Network Security Services (NSS) 中 mp_div 和 mp_exptmod 的计算可产生错误结果 (bsc#963731)

已添加以下改进：

- bsc#954447：Mozilla NSS 现在支持一些新的 DHE 加密套件

- 现在默认启用跟踪保护

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

此 MozillaFirefox、MozillaFirefox-branding-SLE、mozilla-nss 更新可修复以下问题：(bsc#963520)

Mozilla Firefox 已更新到 38.6.0 ESR。Mozilla NSS 已更新到 3.20.2。

修复了以下漏洞：

- CVE-2016-1930：内存安全缺陷已在 Firefox ESR 38.6 中修复 (bsc#963632)

- CVE-2016-1935：内存不足分配后在 WebGL 中发生缓冲区溢出 (bsc#963635)

- CVE-2016-1938：Network Security Services (NSS) 中 mp_div 和 mp_exptmod 的计算可产生错误结果 (bsc#963731)

已添加以下改进：

- bsc#954447：Mozilla NSS 现在支持一些新的 DHE 加密套件

- 现在默认启用跟踪保护

- bsc#964332：修复了 FIPS 自我检查代码中的泄漏文件描述符

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程主机受到 GLSA-201605-06 中所述漏洞的影响（Mozilla 产品：多种漏洞）

在 Firefox、NSS、NSPR 和 Thunderbird 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。
 影响：

远程攻击者可引诱用户查看特别构建的网页或电子邮件，这可能导致执行任意代码或拒绝服务的情况。此外，远程攻击者可能可以执行中间人攻击、获取敏感信息、欺骗地址栏、执行点击劫持攻击、绕过安全限制和保护机制，或造成其他不明影响。
 变通方案：

目前无任何已知的变通方案。

The version of Firefox is prior to 44.0 and is affected by multiple vulnerabilities : 

 - Multiple unspecified memory corruption issues exist that allow a remote attacker to execute arbitrary code. (CVE-2016-1930, CVE-2016-1931)
 - An integer overflow condition exists due to improper parsing of GIF images during deinterlacing. A remote attacker can exploit this, via a specially crafted GIF image, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1933)
 - A buffer overflow condition exists in WebGL that is triggered when handling cache out-of-memory error conditions. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1935)
 - A content spoofing vulnerability exists due to the protocol handler dialog treating double click events as two single click events. A remote attacker can exploit this to spoof content, allowing the attacker to trick a user into performing malicious actions. (CVE-2016-1937)
 - A cryptographic weakness exists in Network Security Services (NSS) due to incorrect calculations with 'mp_div' and 'mp_exptmod'. (CVE-2016-1938)
 - A cookie injection vulnerability exists due to illegal control characters being permitted in cookie names. A remote attacker can exploit this to inject cookies. (CVE-2016-1939)
 - A flaw exists that is triggered as the delay between the download dialog getting focus and the button getting enabled is too short. If a context-dependent attacker can trick a user into double clicking in a specific location, they can pass the second click through to a dialog below that location. This will allow the attacker to cause the user to perform unintentional actions. (CVE-2016-1941)
 - An URL spoofing vulnerability exists due to a flaw that is triggered during the handling of a URL that invalid for the internal protocol, causing the URL to be pasted into the address bar. A remote attacker can exploit this spoof URLs, allowing the attacker to trick a user into visiting a malicious website. (CVE-2016-1942)
 - An unspecified memory corruption issue exists in the ANGLE graphics library implementation. A remote attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2016-1944)
 - A wild pointer flaw exists due to improper handling of ZIP files. A remote attacker can exploit this, via a crafted ZIP file, to have an unspecified impact. (CVE-2016-1945)
 - An integer overflow condition exists in the bundled version of libstagefright due to improper handling of MP4 file metadata. A remote attacker can exploit this to execute arbitrary code. (CVE-2016-1946)
 - A flaw exists in the safe browsing feature due to the Application Reputation service being unreachable. A remote attacker can exploit this to convince a user into downloading a malicious executable without being warned. (CVE-2016-1947)

ID	Name	Product	Family	Published	Updated	Severity
88830	openSUSE 安全更新：Thunderbird (openSUSE-2016-225) (SLOTH)	Nessus	SuSE Local Security Checks	2/18/2016	1/19/2021	critical
88619	SUSE SLED11 / SLES11 安全更新：MozillaFirefox、MozillaFirefox-branding-SLED、mozilla-nss (SUSE-SU-2016:0334-1)	Nessus	SuSE Local Security Checks	2/8/2016	1/6/2021	critical
88620	SUSE SLED12 / SLES12 安全更新：MozillaFirefox、MozillaFirefox-branding-SLE、mozilla-nss (SUSE-SU-2016:0338-1)	Nessus	SuSE Local Security Checks	2/8/2016	1/6/2021	critical
91379	GLSA-201605-06：Mozilla 产品：多种漏洞	Nessus	Gentoo Local Security Checks	5/31/2016	12/5/2022	critical
9075	Mozilla Firefox < 44.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2/19/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical