openSUSE Security Update: Security update for Mozilla Firefox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2016:2735-1
Rating:             important
References:         #1006475 #1006476 
Cross-References:   CVE-2016-5287 CVE-2016-5288
Affected Products:
                    openSUSE 13.1
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:

   Mozilla Firefox was updated to 49.0.2 to fix two security issues and some
   bugs.

      The following vulnerabilities were fixed:

      * CVE-2016-5287: Crash in nsTArray_base (bsc#1006475)
      * CVE-2016-5288: Web content can read cache entries (bsc#1006476)

      The following changes and fixes are included:

      * Asynchronous rendering of the Flash plugins is now enabled by default
      * Change D3D9 default fallback preference to prevent graphical artifacts
      * Network issue prevents some users from seeing the Firefox UI on
        startup
      * Web compatibility issue with file uploads
      * Web compatibility issue with Array.prototype.values
      * Diagnostic information on timing for tab switching
      * Fix a Canvas filters graphics issue affecting HTML5 apps


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 13.1:

      zypper in -t patch 2016-1271=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 13.1 (i586 x86_64):

      MozillaFirefox-49.0.2-128.1
      MozillaFirefox-branding-upstream-49.0.2-128.1
      MozillaFirefox-buildsymbols-49.0.2-128.1
      MozillaFirefox-debuginfo-49.0.2-128.1
      MozillaFirefox-debugsource-49.0.2-128.1
      MozillaFirefox-devel-49.0.2-128.1
      MozillaFirefox-translations-common-49.0.2-128.1
      MozillaFirefox-translations-other-49.0.2-128.1


References:

   https://www.suse.com/security/cve/CVE-2016-5287.html
   https://www.suse.com/security/cve/CVE-2016-5288.html
   https://bugzilla.suse.com/1006475
   https://bugzilla.suse.com/1006476