SuSE: 2017:0427-1: important: MozillaFirefox
Summary
MozillaFirefox 45 ESR was updated to 45.7 to fix the following issues (bsc#1021991): * MFSA 2017-02/CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bsc#1021818) * MFSA 2017-02/CVE-2017-5396: Use-after-free with Media Decoder (bsc#1021821) * MFSA 2017-02/CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bsc#1021823) * MFSA 2017-02/CVE-2017-5380: Potential use-after-free during DOM manipulations (bsc#1021819) * MFSA 2017-02/CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bsc#1021820) * MFSA 2017-02/CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7 (bsc#1021824) * MFSA 2017-02/CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bsc#1021814) * MFSA 2017-02/CVE-2017-5376: Use-after-free in XSL (bsc#1021817) * MFSA 2017-02/CVE-2017-5383: Location bar spoofing with unicode characters (bsc#1021822) Please see https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ for more information. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP2: zypper in -t patch SUSE-SLE-SDK-12-SP2-2017-217=1 - SUSE Linux Enterprise Software Development Kit 12-SP1: zypper in -t patch SUSE-SLE-SDK-12-SP1-2017-217=1 - SUSE Linux Enterprise Server for SAP 12: zypper in -t patch SUSE-SLE-SAP-12-2017-217=1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2: zypper in -t patch SUSE-SLE-RPI-12-SP2-2017-217=1 - SUSE Linux Enterprise Server 12-SP2: zypper in -t patch SUSE-SLE-SERVER-12-SP2-2017-217=1 - SUSE Linux Enterprise Server 12-SP1: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2017-217=1 - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-2017-217=1 - SUSE Linux Enterprise Desktop 12-SP2: zypper in -t patch SUSE-SLE-DESKTOP-12-SP2-2017-217=1 - SUSE Linux Enterprise Desktop 12-SP1: zypper in -t patch SUSE-SLE-DESKTOP-12-SP1-2017-217=1 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 12-SP2 (aarch64 ppc64le s390x x86_64): MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-devel-45.7.0esr-99.1 - SUSE Linux Enterprise Software Development Kit 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-devel-45.7.0esr-99.1 - SUSE Linux Enterprise Server for SAP 12 (x86_64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1 - SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (aarch64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1 - SUSE Linux Enterprise Server 12-SP2 (aarch64 ppc64le x86_64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1 - SUSE Linux Enterprise Server 12-SP1 (ppc64le s390x x86_64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1 - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1 - SUSE Linux Enterprise Desktop 12-SP2 (x86_64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1 - SUSE Linux Enterprise Desktop 12-SP1 (x86_64): MozillaFirefox-45.7.0esr-99.1 MozillaFirefox-debuginfo-45.7.0esr-99.1 MozillaFirefox-debugsource-45.7.0esr-99.1 MozillaFirefox-translations-45.7.0esr-99.1
References
#1021814 #1021817 #1021818 #1021819 #1021820
#1021821 #1021822 #1021823 #1021824 #1021991
Cross- CVE-2017-5373 CVE-2017-5375 CVE-2017-5376
CVE-2017-5378 CVE-2017-5380 CVE-2017-5383
CVE-2017-5386 CVE-2017-5390 CVE-2017-5396
Affected Products:
SUSE Linux Enterprise Software Development Kit 12-SP2
SUSE Linux Enterprise Software Development Kit 12-SP1
SUSE Linux Enterprise Server for SAP 12
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2
SUSE Linux Enterprise Server 12-SP2
SUSE Linux Enterprise Server 12-SP1
SUSE Linux Enterprise Server 12-LTSS
SUSE Linux Enterprise Desktop 12-SP2
SUSE Linux Enterprise Desktop 12-SP1
https://www.suse.com/security/cve/CVE-2017-5373.html
https://www.suse.com/security/cve/CVE-2017-5375.html
https://www.suse.com/security/cve/CVE-2017-5376.html
https://www.suse.com/security/cve/CVE-2017-5378.html
https://www.suse.com/security/cve/CVE-2017-5380.html
https://www.suse.com/security/cve/CVE-2017-5383.html
https://www.suse.com/security/cve/CVE-2017-5386.html
https://www.suse.com/security/cve/CVE-2017-5390.html
https://www.suse.com/security/cve/CVE-2017-5396.html
https://bugzilla.suse.com/1021814
https://bugzilla.suse.com/1021817
https://bugzilla.suse.com/1021818
https://bugzilla.suse.com/1021819
https://bugzilla.suse.com/1021820
https://bugzilla.suse.com/1021821
https://bugzilla.suse.com/1021822
https://bugzilla.suse.com/1021823
https://bugzilla.suse.com/1021824
https://bugzilla.suse.com/1021991