Lucene search

K
suseSuseOPENSUSE-SU-2016:3310-1
HistoryDec 31, 2016 - 3:08 a.m.

Security update for MozillaFirefox (important)

2016-12-3103:08:01
lists.opensuse.org
38

0.866 High

EPSS

Percentile

98.3%

This update to MozillaFirefox 50.1.0 fixes the following
vulnerabilities:

  - CVE-2016-9894: Buffer overflow in SkiaGL
  - CVE-2016-9899: Use-after-free while manipulating DOM events and audio
    elements
  - CVE-2016-9895: CSP bypass using marquee tag
  - CVE-2016-9896: Use-after-free with WebVR
  - CVE-2016-9897: Memory corruption in libGLES
  - CVE-2016-9898: Use-after-free in Editor while manipulating DOM
    subtrees
  - CVE-2016-9900: Restricted external resources can be loaded by SVG
    images through data URLs
  - CVE-2016-9904: Cross-origin information leak in shared atoms
  - CVE-2016-9901: Data from Pocket server improperly sanitized before
    execution
  - CVE-2016-9902: Pocket extension does not validate the origin of events
  - CVE-2016-9903: XSS injection vulnerability in add-ons SDK
  - CVE-2016-9080: Memory safety bugs fixed in Firefox 50.1
  - CVE-2016-9893: Memory safety bugs fixed in Firefox 50.1 and Firefox
    ESR 45.6

  The following bugs were fixed:

  - boo#1011922: fix crash after a few seconds of usage on AArch64