openSUSE Security Update: Security update for MozillaFirefox, mozilla-nss ______________________________________________________________________________ Announcement ID: openSUSE-SU-2015:1229-1 Rating: important References: #932142 #933439 #935979 Cross-References: CVE-2015-2721 CVE-2015-2722 CVE-2015-2724 CVE-2015-2725 CVE-2015-2726 CVE-2015-2727 CVE-2015-2728 CVE-2015-2729 CVE-2015-2730 CVE-2015-2731 CVE-2015-2733 CVE-2015-2734 CVE-2015-2735 CVE-2015-2736 CVE-2015-2737 CVE-2015-2738 CVE-2015-2739 CVE-2015-2740 CVE-2015-2741 CVE-2015-2743 CVE-2015-4000 Affected Products: openSUSE 13.2 openSUSE 13.1 ______________________________________________________________________________ An update that fixes 21 vulnerabilities is now available. Description: MozillaFirefox was updated to version 39.0 to fix 21 security issues. These security issues were fixed: - CVE-2015-2724/CVE-2015-2725/CVE-2015-2726: Miscellaneous memory safety hazards (bsc#935979). - CVE-2015-2727: Local files or privileged URLs in pages can be opened into new tabs (bsc#935979). - CVE-2015-2728: Type confusion in Indexed Database Manager (bsc#935979). - CVE-2015-2729: Out-of-bound read while computing an oscillator rendering range in Web Audio (bsc#935979). - CVE-2015-2731: Use-after-free in Content Policy due to microtask execution error (bsc#935979). - CVE-2015-2730: ECDSA signature validation fails to handle some signatures correctly (bsc#935979). - CVE-2015-2722/CVE-2015-2733: Use-after-free in workers while using XMLHttpRequest (bsc#935979). - CVE-2015-2734/CVE-2015-2735/CVE-2015-2736/CVE-2015-2737/CVE-2015-2738/CVE-2 015-2739/CVE-2015-2740: Vulnerabilities found through code inspection (bsc#935979). - CVE-2015-2741: Key pinning is ignored when overridable errors are encountered (bsc#935979). - CVE-2015-2743: Privilege escalation in PDF.js (bsc#935979). - CVE-2015-4000: NSS accepts export-length DHE keys with regular DHE cipher suites (bsc#935979). - CVE-2015-2721: NSS incorrectly permits skipping of ServerKeyExchange (bsc#935979). New features: - Share Hello URLs with social networks - Support for 'switch' role in ARIA 1.1 (web accessibility) - SafeBrowsing malware detection lookups enabled for downloads (Mac OS X and Linux) - Support for new Unicode 8.0 skin tone emoji - Removed support for insecure SSLv3 for network communications - Disable use of RC4 except for temporarily whitelisted hosts - NPAPI Plug-in performance improved via asynchronous initialization mozilla-nss was updated to version 3.19.2 to fix some of the security issues listed above. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.2: zypper in -t patch openSUSE-2015-480=1 - openSUSE 13.1: zypper in -t patch openSUSE-2015-480=1 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.2 (i586 x86_64): MozillaFirefox-39.0-34.2 MozillaFirefox-branding-upstream-39.0-34.2 MozillaFirefox-buildsymbols-39.0-34.2 MozillaFirefox-debuginfo-39.0-34.2 MozillaFirefox-debugsource-39.0-34.2 MozillaFirefox-devel-39.0-34.2 MozillaFirefox-translations-common-39.0-34.2 MozillaFirefox-translations-other-39.0-34.2 libfreebl3-3.19.2-16.1 libfreebl3-debuginfo-3.19.2-16.1 libsoftokn3-3.19.2-16.1 libsoftokn3-debuginfo-3.19.2-16.1 mozilla-nss-3.19.2-16.1 mozilla-nss-certs-3.19.2-16.1 mozilla-nss-certs-debuginfo-3.19.2-16.1 mozilla-nss-debuginfo-3.19.2-16.1 mozilla-nss-debugsource-3.19.2-16.1 mozilla-nss-devel-3.19.2-16.1 mozilla-nss-sysinit-3.19.2-16.1 mozilla-nss-sysinit-debuginfo-3.19.2-16.1 mozilla-nss-tools-3.19.2-16.1 mozilla-nss-tools-debuginfo-3.19.2-16.1 - openSUSE 13.2 (x86_64): libfreebl3-32bit-3.19.2-16.1 libfreebl3-debuginfo-32bit-3.19.2-16.1 libsoftokn3-32bit-3.19.2-16.1 libsoftokn3-debuginfo-32bit-3.19.2-16.1 mozilla-nss-32bit-3.19.2-16.1 mozilla-nss-certs-32bit-3.19.2-16.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-16.1 mozilla-nss-debuginfo-32bit-3.19.2-16.1 mozilla-nss-sysinit-32bit-3.19.2-16.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-16.1 - openSUSE 13.1 (i586 x86_64): MozillaFirefox-39.0-78.1 MozillaFirefox-branding-upstream-39.0-78.1 MozillaFirefox-buildsymbols-39.0-78.1 MozillaFirefox-debuginfo-39.0-78.1 MozillaFirefox-debugsource-39.0-78.1 MozillaFirefox-devel-39.0-78.1 MozillaFirefox-translations-common-39.0-78.1 MozillaFirefox-translations-other-39.0-78.1 libfreebl3-3.19.2-59.1 libfreebl3-debuginfo-3.19.2-59.1 libsoftokn3-3.19.2-59.1 libsoftokn3-debuginfo-3.19.2-59.1 mozilla-nss-3.19.2-59.1 mozilla-nss-certs-3.19.2-59.1 mozilla-nss-certs-debuginfo-3.19.2-59.1 mozilla-nss-debuginfo-3.19.2-59.1 mozilla-nss-debugsource-3.19.2-59.1 mozilla-nss-devel-3.19.2-59.1 mozilla-nss-sysinit-3.19.2-59.1 mozilla-nss-sysinit-debuginfo-3.19.2-59.1 mozilla-nss-tools-3.19.2-59.1 mozilla-nss-tools-debuginfo-3.19.2-59.1 - openSUSE 13.1 (x86_64): libfreebl3-32bit-3.19.2-59.1 libfreebl3-debuginfo-32bit-3.19.2-59.1 libsoftokn3-32bit-3.19.2-59.1 libsoftokn3-debuginfo-32bit-3.19.2-59.1 mozilla-nss-32bit-3.19.2-59.1 mozilla-nss-certs-32bit-3.19.2-59.1 mozilla-nss-certs-debuginfo-32bit-3.19.2-59.1 mozilla-nss-debuginfo-32bit-3.19.2-59.1 mozilla-nss-sysinit-32bit-3.19.2-59.1 mozilla-nss-sysinit-debuginfo-32bit-3.19.2-59.1 References: https://www.suse.com/security/cve/CVE-2015-2721.html https://www.suse.com/security/cve/CVE-2015-2722.html https://www.suse.com/security/cve/CVE-2015-2724.html https://www.suse.com/security/cve/CVE-2015-2725.html https://www.suse.com/security/cve/CVE-2015-2726.html https://www.suse.com/security/cve/CVE-2015-2727.html https://www.suse.com/security/cve/CVE-2015-2728.html https://www.suse.com/security/cve/CVE-2015-2729.html https://www.suse.com/security/cve/CVE-2015-2730.html https://www.suse.com/security/cve/CVE-2015-2731.html https://www.suse.com/security/cve/CVE-2015-2733.html https://www.suse.com/security/cve/CVE-2015-2734.html https://www.suse.com/security/cve/CVE-2015-2735.html https://www.suse.com/security/cve/CVE-2015-2736.html https://www.suse.com/security/cve/CVE-2015-2737.html https://www.suse.com/security/cve/CVE-2015-2738.html https://www.suse.com/security/cve/CVE-2015-2739.html https://www.suse.com/security/cve/CVE-2015-2740.html https://www.suse.com/security/cve/CVE-2015-2741.html https://www.suse.com/security/cve/CVE-2015-2743.html https://www.suse.com/security/cve/CVE-2015-4000.html https://bugzilla.suse.com/932142 https://bugzilla.suse.com/933439 https://bugzilla.suse.com/935979