openSUSE Security Update: Security update for MozillaFirefox
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2016:2994-1
Rating:             important
References:         #1012807 #1012964 
Cross-References:   CVE-2016-9078 CVE-2016-9079
Affected Products:
                    openSUSE Leap 42.2
                    openSUSE Leap 42.1
                    openSUSE 13.2
______________________________________________________________________________

   An update that fixes two vulnerabilities is now available.

Description:


   MozillaFirefox is updated to version 50.0.2 which fixes the following
   issues:

    * Firefox crashed with 3rd party Chinese IME when using IME text (fixed
      in version 50.0.1)
    * Redirection from an HTTP connection to a data: URL could inherit wrong
      origin after an HTTP redirect (fixed in version 50.0.1, bmo#1317641,
      MFSA 2016-91, boo#1012807, CVE-2016-9078)
    * Maliciously crafted SVG animations could cause remote code execution
      (fixed in version 50.0.2, bmo#1321066, MFSA 2016-92, boo##1012964,
      CVE-2016-9079)


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.2:

      zypper in -t patch openSUSE-2016-1392=1

   - openSUSE Leap 42.1:

      zypper in -t patch openSUSE-2016-1392=1

   - openSUSE 13.2:

      zypper in -t patch openSUSE-2016-1392=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE Leap 42.2 (i586 x86_64):

      MozillaFirefox-50.0.2-42.2
      MozillaFirefox-branding-upstream-50.0.2-42.2
      MozillaFirefox-buildsymbols-50.0.2-42.2
      MozillaFirefox-debuginfo-50.0.2-42.2
      MozillaFirefox-debugsource-50.0.2-42.2
      MozillaFirefox-devel-50.0.2-42.2
      MozillaFirefox-translations-common-50.0.2-42.2
      MozillaFirefox-translations-other-50.0.2-42.2

   - openSUSE Leap 42.1 (x86_64):

      MozillaFirefox-50.0.2-42.1
      MozillaFirefox-branding-upstream-50.0.2-42.1
      MozillaFirefox-buildsymbols-50.0.2-42.1
      MozillaFirefox-debuginfo-50.0.2-42.1
      MozillaFirefox-debugsource-50.0.2-42.1
      MozillaFirefox-devel-50.0.2-42.1
      MozillaFirefox-translations-common-50.0.2-42.1
      MozillaFirefox-translations-other-50.0.2-42.1

   - openSUSE 13.2 (i586 x86_64):

      MozillaFirefox-50.0.2-91.1
      MozillaFirefox-branding-upstream-50.0.2-91.1
      MozillaFirefox-buildsymbols-50.0.2-91.1
      MozillaFirefox-debuginfo-50.0.2-91.1
      MozillaFirefox-debugsource-50.0.2-91.1
      MozillaFirefox-devel-50.0.2-91.1
      MozillaFirefox-translations-common-50.0.2-91.1
      MozillaFirefox-translations-other-50.0.2-91.1


References:

   https://www.suse.com/security/cve/CVE-2016-9078.html
   https://www.suse.com/security/cve/CVE-2016-9079.html
   https://bugzilla.suse.com/1012807
   https://bugzilla.suse.com/1012964