[security-announce] openSUSE-SU-2013:1633-1: important: Mozilla Suite: Update to October 2013 release

7 Nov 2013

      openSUSE Security Update: Mozilla Suite: Update to October 2013 release
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2013:1633-1
Rating:             important
References:         #840485 #847708 
Cross-References:   CVE-2013-1705 CVE-2013-1718 CVE-2013-1722
                    CVE-2013-1725 CVE-2013-1730 CVE-2013-1732
                    CVE-2013-1735 CVE-2013-1736 CVE-2013-1737
                    CVE-2013-5590 CVE-2013-5591 CVE-2013-5592
                    CVE-2013-5593 CVE-2013-5595 CVE-2013-5596
                    CVE-2013-5597 CVE-2013-5598 CVE-2013-5599
                    CVE-2013-5600 CVE-2013-5601 CVE-2013-5602
                    CVE-2013-5603 CVE-2013-5604
Affected Products:
                    openSUSE 12.3
                    openSUSE 12.2
______________________________________________________________________________

   An update that fixes 23 vulnerabilities is now available.

Description:

   MozillaFirefox was updated to Firefox 25.0.
   MozillaThunderbird was updated to Thunderbird 24.1.0.
   Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR
   was updated to 4.10.1.

   Changes in MozillaFirefox:
   * requires NSS 3.15.2 or above
   * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592
   Miscellaneous memory safety hazards
   * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing
   addressbar through SELECT element
   * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access
   violation with XSLT and uninitialized data
   * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly
   initialized memory and overflows in some JavaScript
   functions
   * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to
   cycle collected object during image decoding
   * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free
   when updating offline cache
   * MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass
   of PDF.js checks using iframes
   * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601
   (bmo#915210, bmo#915576, bmo#916685) Miscellaneous
   use-after-free issues found through ASAN fuzzing
   * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory
   corruption in workers
   * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free
   in HTML document templates

   Changes in MozillaThunderbird:
   * requires NSS 3.15.2 or above
   * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592
   Miscellaneous memory safety hazards
   * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing
   addressbar through SELECT element
   * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access
   violation with XSLT and uninitialized data
   * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly
   initialized memory and overflows in some JavaScript
   functions
   * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to
   cycle collected object during image decoding
   * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free
   when updating offline cache
   * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601
   (bmo#915210, bmo#915576, bmo#916685) Miscellaneous
   use-after-free issues found through ASAN fuzzing
   * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory
   corruption in workers
   * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free
   in HTML document templates

   - update to Thunderbird 24.0.1
   * fqdn for smtp server name was not accepted (bmo#913785)
   * fixed crash in PL_strncasecmp (bmo#917955)
   - update Enigmail to 1.6
   * The passphrase timeout configuration in Enigmail is now
   read and written from/to gpg-agent.
   * New dialog to change the expiry date of keys
   * New function to search for the OpenPGP keys of all
   Address Book entries on a keyserver
   * removed obsolete enigmail-build.patch

   Changes in xulrunner:
   - update to 17.0.10esr (bnc#847708)
   * require NSS 3.14.4 or above
   * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592
   Miscellaneous memory safety hazards
   * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access
   violation with XSLT and uninitialized data
   * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly
   initialized memory and overflows in some JavaScript
   functions
   * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free
   when updating offline cache
   * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601
   (bmo#915210, bmo#915576, bmo#916685) Miscellaneous
   use-after-free issues found through ASAN fuzzing
   * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory
   corruption in workers

   - update to 17.0.9esr (bnc#840485)
   * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer
   underflow when generating CRMF requests
   * MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety
   hazards
   * MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free
   in Animation Manager during stylesheet cloning
   * MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope
   for new Javascript objects can lead to memory corruption
   * MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment
   mismatch re-attaching XBL-backed nodes
   * MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow
   with multi-column, lists, and floats
   * MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871,
   bmo#906301) Memory corruption involving scrolling
   * MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined
   properties on DOM proxies get the wrong "this" object

   Changes in mozilla-nspr:
   - update to version 4.10.1
   * bmo#888273: RWIN Scaling (RFC1323) limited to 2 on
   Windows 7 and 8 (Windows only)
   * bmo#907512: Unix platforms shouldn't mask errors
   specific to Unix domain sockets

Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 12.3:

      zypper in -t patch openSUSE-2013-819

   - openSUSE 12.2:

      zypper in -t patch openSUSE-2013-819

   To bring your system up-to-date, use "zypper patch".

Package List:

   - openSUSE 12.3 (i586 x86_64):

      MozillaFirefox-25.0-1.39.1
      MozillaFirefox-branding-upstream-25.0-1.39.1
      MozillaFirefox-buildsymbols-25.0-1.39.1
      MozillaFirefox-debuginfo-25.0-1.39.1
      MozillaFirefox-debugsource-25.0-1.39.1
      MozillaFirefox-devel-25.0-1.39.1
      MozillaFirefox-translations-common-25.0-1.39.1
      MozillaFirefox-translations-other-25.0-1.39.1
      MozillaThunderbird-24.1.0-61.31.1
      MozillaThunderbird-buildsymbols-24.1.0-61.31.1
      MozillaThunderbird-debuginfo-24.1.0-61.31.1
      MozillaThunderbird-debugsource-24.1.0-61.31.1
      MozillaThunderbird-devel-24.1.0-61.31.1
      MozillaThunderbird-translations-common-24.1.0-61.31.1
      MozillaThunderbird-translations-other-24.1.0-61.31.1
      enigmail-1.6.0+24.1.0-61.31.1
      enigmail-debuginfo-1.6.0+24.1.0-61.31.1
      mozilla-js-17.0.10-1.30.2
      mozilla-js-debuginfo-17.0.10-1.30.2
      mozilla-nspr-4.10.1-1.18.1
      mozilla-nspr-debuginfo-4.10.1-1.18.1
      mozilla-nspr-debugsource-4.10.1-1.18.1
      mozilla-nspr-devel-4.10.1-1.18.1
      xulrunner-17.0.10-1.30.2
      xulrunner-buildsymbols-17.0.10-1.30.2
      xulrunner-debuginfo-17.0.10-1.30.2
      xulrunner-debugsource-17.0.10-1.30.2
      xulrunner-devel-17.0.10-1.30.2
      xulrunner-devel-debuginfo-17.0.10-1.30.2

   - openSUSE 12.3 (x86_64):

      mozilla-js-32bit-17.0.10-1.30.2
      mozilla-js-debuginfo-32bit-17.0.10-1.30.2
      mozilla-nspr-32bit-4.10.1-1.18.1
      mozilla-nspr-debuginfo-32bit-4.10.1-1.18.1
      xulrunner-32bit-17.0.10-1.30.2
      xulrunner-debuginfo-32bit-17.0.10-1.30.2

   - openSUSE 12.2 (i586 x86_64):

      MozillaFirefox-25.0-2.63.1
      MozillaFirefox-branding-upstream-25.0-2.63.1
      MozillaFirefox-buildsymbols-25.0-2.63.1
      MozillaFirefox-debuginfo-25.0-2.63.1
      MozillaFirefox-debugsource-25.0-2.63.1
      MozillaFirefox-devel-25.0-2.63.1
      MozillaFirefox-translations-common-25.0-2.63.1
      MozillaFirefox-translations-other-25.0-2.63.1
      MozillaThunderbird-24.1.0-49.59.2
      MozillaThunderbird-buildsymbols-24.1.0-49.59.2
      MozillaThunderbird-debuginfo-24.1.0-49.59.2
      MozillaThunderbird-debugsource-24.1.0-49.59.2
      MozillaThunderbird-devel-24.1.0-49.59.2
      MozillaThunderbird-translations-common-24.1.0-49.59.2
      MozillaThunderbird-translations-other-24.1.0-49.59.2
      enigmail-1.6.0+24.1.0-49.59.2
      mozilla-js-17.0.10-2.56.2
      mozilla-js-debuginfo-17.0.10-2.56.2
      mozilla-nspr-4.10.1-1.20.1
      mozilla-nspr-debuginfo-4.10.1-1.20.1
      mozilla-nspr-debugsource-4.10.1-1.20.1
      mozilla-nspr-devel-4.10.1-1.20.1
      xulrunner-17.0.10-2.56.2
      xulrunner-buildsymbols-17.0.10-2.56.2
      xulrunner-debuginfo-17.0.10-2.56.2
      xulrunner-debugsource-17.0.10-2.56.2
      xulrunner-devel-17.0.10-2.56.2
      xulrunner-devel-debuginfo-17.0.10-2.56.2

   - openSUSE 12.2 (x86_64):

      mozilla-js-32bit-17.0.10-2.56.2
      mozilla-js-debuginfo-32bit-17.0.10-2.56.2
      mozilla-nspr-32bit-4.10.1-1.20.1
      mozilla-nspr-debuginfo-32bit-4.10.1-1.20.1
      xulrunner-32bit-17.0.10-2.56.2
      xulrunner-debuginfo-32bit-17.0.10-2.56.2

References:

   http://support.novell.com/security/cve/CVE-2013-1705.html
   http://support.novell.com/security/cve/CVE-2013-1718.html
   http://support.novell.com/security/cve/CVE-2013-1722.html
   http://support.novell.com/security/cve/CVE-2013-1725.html
   http://support.novell.com/security/cve/CVE-2013-1730.html
   http://support.novell.com/security/cve/CVE-2013-1732.html
   http://support.novell.com/security/cve/CVE-2013-1735.html
   http://support.novell.com/security/cve/CVE-2013-1736.html
   http://support.novell.com/security/cve/CVE-2013-1737.html
   http://support.novell.com/security/cve/CVE-2013-5590.html
   http://support.novell.com/security/cve/CVE-2013-5591.html
   http://support.novell.com/security/cve/CVE-2013-5592.html
   http://support.novell.com/security/cve/CVE-2013-5593.html
   http://support.novell.com/security/cve/CVE-2013-5595.html
   http://support.novell.com/security/cve/CVE-2013-5596.html
   http://support.novell.com/security/cve/CVE-2013-5597.html
   http://support.novell.com/security/cve/CVE-2013-5598.html
   http://support.novell.com/security/cve/CVE-2013-5599.html
   http://support.novell.com/security/cve/CVE-2013-5600.html
   http://support.novell.com/security/cve/CVE-2013-5601.html
   http://support.novell.com/security/cve/CVE-2013-5602.html
   http://support.novell.com/security/cve/CVE-2013-5603.html
   http://support.novell.com/security/cve/CVE-2013-5604.html
   https://bugzilla.novell.com/840485
   https://bugzilla.novell.com/847708

-- 
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

opensuse-security＠opensuse.org

tags

participants (1)