openSUSE Security Update: MozillaFirefox: Update to Firefox 22.0 release
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2013:1142-1
Rating:             important
References:         #825935 
Cross-References:   CVE-2013-1682 CVE-2013-1683 CVE-2013-1684
                    CVE-2013-1685 CVE-2013-1686 CVE-2013-1687
                    CVE-2013-1688 CVE-2013-1690 CVE-2013-1692
                    CVE-2013-1693 CVE-2013-1694 CVE-2013-1695
                    CVE-2013-1696 CVE-2013-1697 CVE-2013-1698
                    CVE-2013-1699
Affected Products:
                    openSUSE 12.3
                    openSUSE 12.2
______________________________________________________________________________

   An update that fixes 16 vulnerabilities is now available.

Description:


   MozillaFirefox was updated to Firefox 22.0 (bnc#825935)

   Following security issues were fixed:
   * MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous
   memory safety hazards
   * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686
   Memory corruption found using Address Sanitizer
   * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823)
   Privileged content access and execution via XBL
   * MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code
   execution within Profiler
   * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of
   unmapped memory through onreadystatechange event
   * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the
   body of XHR HEAD requests leads to CSRF attacks
   * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can
   lead to information disclosure
   * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper
   has inconsistent behavior
   * MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox
   restrictions not applied to nested frame elements
   * MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options
   ignored when using server push with multi-part responses
   * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers   can be bypassed to run user defined methods in a
   privileged context
   * MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia
   permission dialog incorrectly displays location
   * MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph
   domain spoofing in .com, .net and .name


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 12.3:

      zypper in -t patch openSUSE-2013-556

   - openSUSE 12.2:

      zypper in -t patch openSUSE-2013-556

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 12.3 (i586 x86_64):

      MozillaFirefox-22.0-1.25.1
      MozillaFirefox-branding-upstream-22.0-1.25.1
      MozillaFirefox-buildsymbols-22.0-1.25.1
      MozillaFirefox-debuginfo-22.0-1.25.1
      MozillaFirefox-debugsource-22.0-1.25.1
      MozillaFirefox-devel-22.0-1.25.1
      MozillaFirefox-translations-common-22.0-1.25.1
      MozillaFirefox-translations-other-22.0-1.25.1
      mozilla-nspr-4.9.6-1.10.1
      mozilla-nspr-debuginfo-4.9.6-1.10.1
      mozilla-nspr-debugsource-4.9.6-1.10.1
      mozilla-nspr-devel-4.9.6-1.10.1

   - openSUSE 12.3 (x86_64):

      mozilla-nspr-32bit-4.9.6-1.10.1
      mozilla-nspr-debuginfo-32bit-4.9.6-1.10.1

   - openSUSE 12.2 (i586 x86_64):

      MozillaFirefox-22.0-2.51.1
      MozillaFirefox-branding-upstream-22.0-2.51.1
      MozillaFirefox-buildsymbols-22.0-2.51.1
      MozillaFirefox-debuginfo-22.0-2.51.1
      MozillaFirefox-debugsource-22.0-2.51.1
      MozillaFirefox-devel-22.0-2.51.1
      MozillaFirefox-translations-common-22.0-2.51.1
      MozillaFirefox-translations-other-22.0-2.51.1


References:

   https://www.suse.com/security/cve/CVE-2013-1682.html
   https://www.suse.com/security/cve/CVE-2013-1683.html
   https://www.suse.com/security/cve/CVE-2013-1684.html
   https://www.suse.com/security/cve/CVE-2013-1685.html
   https://www.suse.com/security/cve/CVE-2013-1686.html
   https://www.suse.com/security/cve/CVE-2013-1687.html
   https://www.suse.com/security/cve/CVE-2013-1688.html
   https://www.suse.com/security/cve/CVE-2013-1690.html
   https://www.suse.com/security/cve/CVE-2013-1692.html
   https://www.suse.com/security/cve/CVE-2013-1693.html
   https://www.suse.com/security/cve/CVE-2013-1694.html
   https://www.suse.com/security/cve/CVE-2013-1695.html
   https://www.suse.com/security/cve/CVE-2013-1696.html
   https://www.suse.com/security/cve/CVE-2013-1697.html
   https://www.suse.com/security/cve/CVE-2013-1698.html
   https://www.suse.com/security/cve/CVE-2013-1699.html
   https://bugzilla.novell.com/825935

openSUSE: 2013:1142-1: important: MozillaFirefox

July 4, 2013
An update that fixes 16 vulnerabilities is now available

Description

MozillaFirefox was updated to Firefox 22.0 (bnc#825935) Following security issues were fixed: * MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards * MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer * MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL * MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler * MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event * MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks * MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure * MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior * MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements * MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses * MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context * MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location * MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name

 

Patch

Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-556 - openSUSE 12.2: zypper in -t patch openSUSE-2013-556 To bring your system up-to-date, use "zypper patch".


Package List

- openSUSE 12.3 (i586 x86_64): MozillaFirefox-22.0-1.25.1 MozillaFirefox-branding-upstream-22.0-1.25.1 MozillaFirefox-buildsymbols-22.0-1.25.1 MozillaFirefox-debuginfo-22.0-1.25.1 MozillaFirefox-debugsource-22.0-1.25.1 MozillaFirefox-devel-22.0-1.25.1 MozillaFirefox-translations-common-22.0-1.25.1 MozillaFirefox-translations-other-22.0-1.25.1 mozilla-nspr-4.9.6-1.10.1 mozilla-nspr-debuginfo-4.9.6-1.10.1 mozilla-nspr-debugsource-4.9.6-1.10.1 mozilla-nspr-devel-4.9.6-1.10.1 - openSUSE 12.3 (x86_64): mozilla-nspr-32bit-4.9.6-1.10.1 mozilla-nspr-debuginfo-32bit-4.9.6-1.10.1 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-22.0-2.51.1 MozillaFirefox-branding-upstream-22.0-2.51.1 MozillaFirefox-buildsymbols-22.0-2.51.1 MozillaFirefox-debuginfo-22.0-2.51.1 MozillaFirefox-debugsource-22.0-2.51.1 MozillaFirefox-devel-22.0-2.51.1 MozillaFirefox-translations-common-22.0-2.51.1 MozillaFirefox-translations-other-22.0-2.51.1


References

https://www.suse.com/security/cve/CVE-2013-1682.html https://www.suse.com/security/cve/CVE-2013-1683.html https://www.suse.com/security/cve/CVE-2013-1684.html https://www.suse.com/security/cve/CVE-2013-1685.html https://www.suse.com/security/cve/CVE-2013-1686.html https://www.suse.com/security/cve/CVE-2013-1687.html https://www.suse.com/security/cve/CVE-2013-1688.html https://www.suse.com/security/cve/CVE-2013-1690.html https://www.suse.com/security/cve/CVE-2013-1692.html https://www.suse.com/security/cve/CVE-2013-1693.html https://www.suse.com/security/cve/CVE-2013-1694.html https://www.suse.com/security/cve/CVE-2013-1695.html https://www.suse.com/security/cve/CVE-2013-1696.html https://www.suse.com/security/cve/CVE-2013-1697.html https://www.suse.com/security/cve/CVE-2013-1698.html https://www.suse.com/security/cve/CVE-2013-1699.html https://bugzilla.novell.com/825935


Severity
Announcement ID: openSUSE-SU-2013:1142-1
Rating: important
Affected Products: openSUSE 12.3 openSUSE 12.2 .

Related News

Google Chrome 129: Addressing Crucial Vulnerabilities and Enhancing Security
2 - 4 min read
Google Chrome remains the crown jewel in the browser market, with an impressive user base of approximately 3.45 billion. However, this immense
Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is
CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved