Security update for MozillaFirefox SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2016:3048-1 Final 1 1 2016-12-07T16:36:01Z current 2016-12-07T16:36:01Z 2016-12-07T16:36:01Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for MozillaFirefox This update for MozillaFirefox fixes security issues. The following vulnerabilities were fixed in Firefox ESR 45.5.1 (bbsc#1012964): - CVE-2016-9079: Use-after-free in SVG Animation could be used for code execution (MFSA 2016-92 bsc#1012964) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2016-1771,SUSE-SLE-DESKTOP-12-SP2-2016-1771,SUSE-SLE-RPI-12-SP2-2016-1771,SUSE-SLE-SAP-12-2016-1771,SUSE-SLE-SDK-12-SP1-2016-1771,SUSE-SLE-SDK-12-SP2-2016-1771,SUSE-SLE-SERVER-12-2016-1771,SUSE-SLE-SERVER-12-SP1-2016-1771,SUSE-SLE-SERVER-12-SP2-2016-1771 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2016/suse-su-20163048-1/ Link for SUSE-SU-2016:3048-1 https://lists.opensuse.org/opensuse-security-announce/2016-12/msg00024.html E-Mail link for SUSE-SU-2016:3048-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1012964 SUSE Bug 1012964 https://www.suse.com/security/cve/CVE-2016-9079/ SUSE CVE CVE-2016-9079 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP1 SUSE Linux Enterprise Software Development Kit 12 SP2 MozillaFirefox-45.5.1esr-93.1 MozillaFirefox-translations-45.5.1esr-93.1 MozillaFirefox-devel-45.5.1esr-93.1 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server 12 SP1 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server 12 SP1 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server 12 SP2 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server 12 SP2 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server 12-LTSS MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server 12-LTSS MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 MozillaFirefox-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 MozillaFirefox-translations-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 MozillaFirefox-devel-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP1 MozillaFirefox-devel-45.5.1esr-93.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1. CVE-2016-9079 SUSE Linux Enterprise Desktop 12 SP1:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Desktop 12 SP1:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Desktop 12 SP2:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Desktop 12 SP2:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server 12 SP1:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server 12 SP1:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Server for SAP Applications 12:MozillaFirefox-45.5.1esr-93.1 SUSE Linux Enterprise Server for SAP Applications 12:MozillaFirefox-translations-45.5.1esr-93.1 SUSE Linux Enterprise Software Development Kit 12 SP1:MozillaFirefox-devel-45.5.1esr-93.1 SUSE Linux Enterprise Software Development Kit 12 SP2:MozillaFirefox-devel-45.5.1esr-93.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2016/suse-su-20163048-1/ https://www.suse.com/security/cve/CVE-2016-9079.html CVE-2016-9079 https://bugzilla.suse.com/1012964 SUSE Bug 1012964