openSUSE-SU-2011:0437-1 (important): mozilla-xulrunner192: Update to 1.9.2.17 security release

6 May 2011

      openSUSE Security Update: mozilla-xulrunner192: Update to 1.9.2.17 security release
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2011:0437-1
Rating:             important
References:         #689281 
Affected Products:
                    openSUSE 11.4
                    openSUSE 11.3
                    openSUSE 11.2
______________________________________________________________________________

   An update that contains security fixes can now be
   installed. It includes 8 new package versions.

Description:

   Mozilla XULRunner 1.9.2 was updated to the 1.9.2.17
   security release.

   MFSA 2011-12: Mozilla developers identified and fixed
   several memory safety bugs in the browser engine used in
   Firefox and other Mozilla-based products. Some of these
   bugs showed evidence of memory corruption under certain
   circumstances, and we presume that with enough effort at
   least some of these could be exploited to run arbitrary
   code. Credits

   Mozilla developer Scoobidiver reported a memory safety
   issue which affected Firefox 4 and Firefox 3.6
   (CVE-2011-0081)

   The web development team of Alcidion reported a crash that
   affected Firefox 4, Firefox 3.6 and Firefox 3.5.
   (CVE-2011-0069)

   Ian Beer reported a crash that affected Firefox 4, Firefox
   3.6 and Firefox 3.5. (CVE-2011-0070)

   Mozilla developers Bob Clary, Henri Sivonen, Marco Bonardo,
   Mats Palmgren and Jesse Ruderman reported memory safety
   issues which affected Firefox 3.6 and Firefox 3.5.
   (CVE-2011-0080)

   Aki Helin reported memory safety issues which affected
   Firefox 3.6 and Firefox 3.5. (CVE-2011-0074 , CVE-2011-0075)

   Ian Beer reported memory safety issues which affected
   Firefox 3.6 and Firefox 3.5. (CVE-2011-0077 , CVE-2011-0078)

   Martin Barbella reported a memory safety issue which
   affected Firefox 3.6 and Firefox 3.5. (CVE-2011-0072)

   MFSA 2011-13 / CVE-2011-0065 / CVE-2011-0066 /
   CVE-2011-0073: Security researcher regenrecht reported
   several dangling pointer vulnerabilities via TippingPoint's
   Zero Day Initiative.

   MFSA 2011-14 / CVE-2011-0067: Security researcher Paul
   Stone reported that a Java applet could be used to mimic
   interaction with form autocomplete controls and steal
   entries from the form history.

   MFSA 2011-15 / CVE-2011-0076: David Remahl of Apple Product
   Security reported that the Java Embedding Plugin (JEP)
   shipped with the Mac OS X versions of Firefox could be
   exploited to obtain elevated access to resources on a
   user's system.

   MFSA 2011-16 / CVE-2011-0071: Security researcher Soroush
   Dalili reported that the resource: protocol could be
   exploited to allow directory traversal on Windows and the
   potential loading of resources from non-permitted
   locations. The impact would depend on whether interesting
   files existed in predictable locations in a useful format.
   For example, the existence or non-existence of particular
   images might indicate whether certain software was
   installed.

   MFSA 2011-18 / CVE-2011-1202: Chris Evans of the Chrome
   Security Team reported that the XSLT generate-id() function
   returned a string that revealed a specific valid address of
   an object on the memory heap. It is possible that in some
   cases this address would be valuable information that could
   be used by an attacker while exploiting a different memory
   corruption but, in order to make an exploit more reliable
   or work around mitigation features in the browser or
   operating system.

Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 11.4:

      zypper in -t patch MozillaFirefox-4457 MozillaThunderbird-4458 mozilla-js192-4460 seamonkey-4462

   - openSUSE 11.3:

      zypper in -t patch MozillaFirefox-4459 MozillaThunderbird-4458 mozilla-xulrunner191-4456 seamonkey-4462

   - openSUSE 11.2:

      zypper in -t patch MozillaFirefox-4459 MozillaThunderbird-4458 mozilla-xulrunner191-4456 seamonkey-4462

   To bring your system up-to-date, use "zypper patch".

Package List:

   - openSUSE 11.4 (i586 x86_64) [New Version: 1.9.2.17,2.0.1,2.0.14,3.1.10 and 4.0.1]:

      MozillaFirefox-4.0.1-0.2.2
      MozillaFirefox-branding-upstream-4.0.1-0.2.2
      MozillaFirefox-devel-4.0.1-0.2.2
      MozillaFirefox-translations-common-4.0.1-0.2.2
      MozillaFirefox-translations-other-4.0.1-0.2.2
      MozillaThunderbird-3.1.10-0.5.1
      MozillaThunderbird-buildsymbols-3.1.10-0.5.1
      MozillaThunderbird-devel-3.1.10-0.5.1
      MozillaThunderbird-translations-common-3.1.10-0.5.1
      MozillaThunderbird-translations-other-3.1.10-0.5.1
      enigmail-1.1.2-9.5.1
      mozilla-js192-1.9.2.17-0.2.2
      mozilla-js20-2.0.1-0.2.2
      mozilla-xulrunner192-1.9.2.17-0.2.2
      mozilla-xulrunner192-buildsymbols-1.9.2.17-0.2.2
      mozilla-xulrunner192-devel-1.9.2.17-0.2.2
      mozilla-xulrunner192-gnome-1.9.2.17-0.2.2
      mozilla-xulrunner192-translations-common-1.9.2.17-0.2.2
      mozilla-xulrunner192-translations-other-1.9.2.17-0.2.2
      mozilla-xulrunner20-2.0.1-0.2.2
      mozilla-xulrunner20-buildsymbols-2.0.1-0.2.2
      mozilla-xulrunner20-devel-2.0.1-0.2.2
      mozilla-xulrunner20-gnome-2.0.1-0.2.2
      mozilla-xulrunner20-translations-common-2.0.1-0.2.2
      mozilla-xulrunner20-translations-other-2.0.1-0.2.2
      seamonkey-2.0.14-0.2.1
      seamonkey-dom-inspector-2.0.14-0.2.1
      seamonkey-irc-2.0.14-0.2.1
      seamonkey-translations-common-2.0.14-0.2.1
      seamonkey-translations-other-2.0.14-0.2.1
      seamonkey-venkman-2.0.14-0.2.1

   - openSUSE 11.4 (x86_64) [New Version: 1.9.2.17 and 2.0.1]:

      mozilla-js192-32bit-1.9.2.17-0.2.2
      mozilla-js20-32bit-2.0.1-0.2.2
      mozilla-xulrunner192-32bit-1.9.2.17-0.2.2
      mozilla-xulrunner192-gnome-32bit-1.9.2.17-0.2.2
      mozilla-xulrunner192-translations-common-32bit-1.9.2.17-0.2.2
      mozilla-xulrunner192-translations-other-32bit-1.9.2.17-0.2.2
      mozilla-xulrunner20-32bit-2.0.1-0.2.2
      mozilla-xulrunner20-gnome-32bit-2.0.1-0.2.2
      mozilla-xulrunner20-translations-common-32bit-2.0.1-0.2.2
      mozilla-xulrunner20-translations-other-32bit-2.0.1-0.2.2

   - openSUSE 11.3 (i586 x86_64) [New Version: 1.1.2,1.9.1.19,1.9.2.17,2.0.14,3.1.10 and 3.6.17]:

      MozillaFirefox-3.6.17-0.2.1
      MozillaFirefox-branding-upstream-3.6.17-0.2.1
      MozillaFirefox-translations-common-3.6.17-0.2.1
      MozillaFirefox-translations-other-3.6.17-0.2.1
      MozillaThunderbird-3.1.10-0.9.1
      MozillaThunderbird-devel-3.1.10-0.9.1
      MozillaThunderbird-translations-common-3.1.10-0.9.1
      MozillaThunderbird-translations-other-3.1.10-0.9.1
      enigmail-1.1.2-9.9.1
      mozilla-js192-1.9.2.17-0.2.1
      mozilla-xulrunner191-1.9.1.19-0.2.1
      mozilla-xulrunner191-devel-1.9.1.19-0.2.1
      mozilla-xulrunner191-gnomevfs-1.9.1.19-0.2.1
      mozilla-xulrunner191-translations-common-1.9.1.19-0.2.1
      mozilla-xulrunner191-translations-other-1.9.1.19-0.2.1
      mozilla-xulrunner192-1.9.2.17-0.2.1
      mozilla-xulrunner192-buildsymbols-1.9.2.17-0.2.1
      mozilla-xulrunner192-devel-1.9.2.17-0.2.1
      mozilla-xulrunner192-gnome-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-common-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-other-1.9.2.17-0.2.1
      python-xpcom191-1.9.1.19-0.2.1
      seamonkey-2.0.14-0.2.1
      seamonkey-dom-inspector-2.0.14-0.2.1
      seamonkey-irc-2.0.14-0.2.1
      seamonkey-translations-common-2.0.14-0.2.1
      seamonkey-translations-other-2.0.14-0.2.1
      seamonkey-venkman-2.0.14-0.2.1

   - openSUSE 11.3 (x86_64) [New Version: 1.9.1.19 and 1.9.2.17]:

      mozilla-js192-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner191-32bit-1.9.1.19-0.2.1
      mozilla-xulrunner191-gnomevfs-32bit-1.9.1.19-0.2.1
      mozilla-xulrunner192-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner192-gnome-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-common-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-other-32bit-1.9.2.17-0.2.1

   - openSUSE 11.2 (i586 x86_64) [New Version: 1.1.2,1.9.1.19,1.9.2.17,2.0.14,3.1.10 and 3.6.17]:

      MozillaFirefox-3.6.17-0.2.1
      MozillaFirefox-branding-upstream-3.6.17-0.2.1
      MozillaFirefox-translations-common-3.6.17-0.2.1
      MozillaFirefox-translations-other-3.6.17-0.2.1
      MozillaThunderbird-3.1.10-0.9.1
      MozillaThunderbird-devel-3.1.10-0.9.1
      MozillaThunderbird-translations-common-3.1.10-0.9.1
      MozillaThunderbird-translations-other-3.1.10-0.9.1
      enigmail-1.1.2-9.9.1
      mozilla-js192-1.9.2.17-0.2.1
      mozilla-xulrunner191-1.9.1.19-0.2.1
      mozilla-xulrunner191-devel-1.9.1.19-0.2.1
      mozilla-xulrunner191-gnomevfs-1.9.1.19-0.2.1
      mozilla-xulrunner191-translations-common-1.9.1.19-0.2.1
      mozilla-xulrunner191-translations-other-1.9.1.19-0.2.1
      mozilla-xulrunner192-1.9.2.17-0.2.1
      mozilla-xulrunner192-buildsymbols-1.9.2.17-0.2.1
      mozilla-xulrunner192-devel-1.9.2.17-0.2.1
      mozilla-xulrunner192-gnome-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-common-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-other-1.9.2.17-0.2.1
      python-xpcom191-1.9.1.19-0.2.1
      seamonkey-2.0.14-0.2.1
      seamonkey-dom-inspector-2.0.14-0.2.1
      seamonkey-irc-2.0.14-0.2.1
      seamonkey-venkman-2.0.14-0.2.1

   - openSUSE 11.2 (x86_64) [New Version: 1.9.1.19 and 1.9.2.17]:

      mozilla-js192-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner191-32bit-1.9.1.19-0.2.1
      mozilla-xulrunner191-gnomevfs-32bit-1.9.1.19-0.2.1
      mozilla-xulrunner192-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner192-gnome-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-common-32bit-1.9.2.17-0.2.1
      mozilla-xulrunner192-translations-other-32bit-1.9.2.17-0.2.1

References:

   https://bugzilla.novell.com/689281

openSUSE-SU-2011:0437-1 (important): mozilla-xulrunner192: Update to 1.9.2.17 security release

opensuse-security＠opensuse.org