Lucene search

K
suseSuseOPENSUSE-SU-2016:3184-1
HistoryDec 16, 2016 - 7:08 p.m.

Security update for MozillaFirefox (important)

2016-12-1619:08:55
lists.opensuse.org
24

0.866 High

EPSS

Percentile

98.3%

This update to MozillaFirefox 50.1.0 fixes the following vulnerabilities:

  • CVE-2016-9894: Buffer overflow in SkiaGL
  • CVE-2016-9899: Use-after-free while manipulating DOM events and audio
    elements
  • CVE-2016-9895: CSP bypass using marquee tag
  • CVE-2016-9896: Use-after-free with WebVR
  • CVE-2016-9897: Memory corruption in libGLES
  • CVE-2016-9898: Use-after-free in Editor while manipulating DOM subtrees
  • CVE-2016-9900: Restricted external resources can be loaded by SVG images
    through data URLs
  • CVE-2016-9904: Cross-origin information leak in shared atoms
  • CVE-2016-9901: Data from Pocket server improperly sanitized before
    execution
  • CVE-2016-9902: Pocket extension does not validate the origin of events
  • CVE-2016-9903: XSS injection vulnerability in add-ons SDK
  • CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1
  • CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox ESR
    45.6

The following bugs were fixed:

  • boo#1011922: fix crash after a few seconds of usage on AArch64