FlawAtlas
Search the atlas
SUSE-SU-2016:1691-1 Not scored

Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss and mozilla-nspr were updated to fix nine security issues. MozillaFirefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed: - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) These non-security issues were fixed: - bsc#982366: Unknown SSL protocol error in connections - Fix crashes on aarch64 * Determine page size at runtime (bsc#984006) * Allow aarch64 to work in safe mode (bsc#985659) - Fix crashes on mainframes All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

Exploit probability Not scored
Published June 27, 2016
Required by Not available
Last source change February 4, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Desktop 12 MozillaFirefox
SUSE:Linux Enterprise Desktop 12 MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12 mozilla-nspr
SUSE:Linux Enterprise Desktop 12 mozilla-nss
SUSE:Linux Enterprise Desktop 12 SP1 MozillaFirefox
SUSE:Linux Enterprise Desktop 12 SP1 MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Desktop 12 SP1 mozilla-nspr
SUSE:Linux Enterprise Desktop 12 SP1 mozilla-nss
SUSE:Linux Enterprise Server 12 MozillaFirefox
SUSE:Linux Enterprise Server 12 MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 mozilla-nspr
SUSE:Linux Enterprise Server 12 mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12 SP1 mozilla-nss
SUSE:Linux Enterprise Server 12 SP1 MozillaFirefox
SUSE:Linux Enterprise Server 12 SP1 MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server 12 SP1 mozilla-nspr
SUSE:Linux Enterprise Server 12 SP1 mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 12 mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 MozillaFirefox
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 MozillaFirefox-branding-SLE
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 12 SP1 mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12 MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 mozilla-nspr
SUSE:Linux Enterprise Software Development Kit 12 mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12 SP1 MozillaFirefox
SUSE:Linux Enterprise Software Development Kit 12 SP1 mozilla-nspr

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2016:1691-1

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss and mozilla-nspr were updated to fix nine security issues. MozillaFirefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1. These security issues were fixed: - CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639). - CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651). - CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652). - CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653). - CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655). - CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646). - CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643). - CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638) These non-security issues were fixed: - bsc#982366: Unknown SSL protocol error in connections - Fix crashes on aarch64 * Determine page size at runtime (bsc#984006) * Allow aarch64 to work in safe mode (bsc#985659) - Fix crashes on mainframes All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

View original source

05 / REFERENCES

Further evidence