CVE-2016-2834

Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libfreebl3-3.26.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nss and mozilla-nspr were updated to fix nine security issues.

MozillaFirefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1.

These security issues were fixed:

• CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639).
• CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651).
• CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652).
• CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653).
• CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655).
• CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646).
• CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643).
• CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638)

These non-security issues were fixed:

• bsc#982366: Unknown SSL protocol error in connections
• Fix crashes on aarch64
  • Determine page size at runtime (bsc#984006)
  • Allow aarch64 to work in safe mode (bsc#985659)
• Fix crashes on mainframes

All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

MozillaFirefox, MozillaFirefox-branding-SLE and mozilla-nss were updated to fix nine security issues.

MozillaFirefox was updated to version 45.2.0 ESR. mozilla-nss was updated to version 3.21.1.

These security issues were fixed:

• CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639).
• CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651).
• CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652).
• CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653).
• CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655).
• CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646).
• CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643).
• CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638)

These non-security issues were fixed:

• Fix crashes on aarch64
  • Determine page size at runtime (bsc#984006)
  • Allow aarch64 to work in safe mode (bsc#985659)
• Fix crashes on mainframes

All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr and mozilla-nss were updated to fix nine security issues.

MozillaFirefox was updated to version 45.3.0 ESR. mozilla-nss was updated to version 3.21.1, mozilla-nspr to version 4.12.

These security issues were fixed in 45.3.0ESR:

• CVE-2016-2835/CVE-2016-2836: Miscellaneous memory safety hazards (rv:48.0 / rv:45.3) (MFSA 2016-62)
• CVE-2016-2830: Favicon network connection can persist when page is closed (MFSA 2016-63)
• CVE-2016-2838: Buffer overflow rendering SVG with bidirectional content (MFSA 2016-64)
• CVE-2016-2839: Cairo rendering crash due to memory allocation issue with FFmpeg 0.10 (MFSA 2016-65)
• CVE-2016-5252: Stack underflow during 2D graphics rendering (MFSA 2016-67)
• CVE-2016-5254: Use-after-free when using alt key and toplevel menus (MFSA 2016-70)
• CVE-2016-5258: Use-after-free in DTLS during WebRTC session shutdown (MFSA 2016-72)
• CVE-2016-5259: Use-after-free in service workers with nested sync events (MFSA 2016-73)
• CVE-2016-5262: Scripts on marquee tag can execute in sandboxed iframes (MFSA 2016-76)
• CVE-2016-2837: Buffer overflow in ClearKey Content Decryption Module (CDM) during video playback (MFSA 2016-77)
• CVE-2016-5263: Type confusion in display transformation (MFSA 2016-78)
• CVE-2016-5264: Use-after-free when applying SVG effects (MFSA 2016-79)
• CVE-2016-5265: Same-origin policy violation using local HTML file and saved shortcut file (MFSA 2016-80)
• CVE-2016-6354: Fix for possible buffer overrun (bsc#990856)

Security issues fixed in 45.2.0.ESR:

• CVE-2016-2834: Memory safety bugs in NSS (MFSA 2016-61) (bsc#983639).
• CVE-2016-2824: Out-of-bounds write with WebGL shader (MFSA 2016-53) (bsc#983651).
• CVE-2016-2822: Addressbar spoofing though the SELECT element (MFSA 2016-52) (bsc#983652).
• CVE-2016-2821: Use-after-free deleting tables from a contenteditable document (MFSA 2016-51) (bsc#983653).
• CVE-2016-2819: Buffer overflow parsing HTML5 fragments (MFSA 2016-50) (bsc#983655).
• CVE-2016-2828: Use-after-free when textures are used in WebGL operations after recycle pool destruction (MFSA 2016-56) (bsc#983646).
• CVE-2016-2831: Entering fullscreen and persistent pointerlock without user permission (MFSA 2016-58) (bsc#983643).
• CVE-2016-2815, CVE-2016-2818: Miscellaneous memory safety hazards (MFSA 2016-49) (bsc#983638)

These non-security issues were fixed:

• Fix crashes on aarch64
  • Determine page size at runtime (bsc#984006)
  • Allow aarch64 to work in safe mode (bsc#985659)
• Fix crashes on mainframes
• Temporarily bind Firefox to the first CPU as a hotfix for an apparent race condition (bsc#989196, bsc#990628)

All extensions must now be signed by addons.mozilla.org. Please read README.SUSE for more details.

Mozilla Firefox was updated to the Firefox ESR release 45.9.

Mozilla NSS was updated to support TLS 1.3 (close to release draft) and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes.

Security issues fixed in Firefox (bsc#1035082)

• MFSA 2017-11/CVE-2017-5469: Potential Buffer overflow in flex-generated code
• MFSA 2017-11/CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1
• MFSA 2017-11/CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing
• MFSA 2017-11/CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing
• MFSA 2017-11/CVE-2017-5437: Vulnerabilities in Libevent library
• MFSA 2017-11/CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2
• MFSA 2017-11/CVE-2017-5435: Use-after-free during transaction processing in the editor
• MFSA 2017-11/CVE-2017-5434: Use-after-free during focus handling
• MFSA 2017-11/CVE-2017-5433: Use-after-free in SMIL animation functions
• MFSA 2017-11/CVE-2017-5432: Use-after-free in text input selection
• MFSA 2017-11/CVE-2017-5464: Memory corruption with accessibility and DOM manipulation
• MFSA 2017-11/CVE-2017-5465: Out-of-bounds read in ConvolvePixel
• MFSA 2017-11/CVE-2017-5460: Use-after-free in frame selection
• MFSA 2017-11/CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor
• MFSA 2017-11/CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data
• MFSA 2017-11/CVE-2017-5447: Out-of-bounds read during glyph processing
• MFSA 2017-11/CVE-2017-5444: Buffer overflow while parsing application/http-index-format content
• MFSA 2017-11/CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content
• MFSA 2017-11/CVE-2017-5442: Use-after-free during style changes
• MFSA 2017-11/CVE-2017-5443: Out-of-bounds write during BinHex decoding
• MFSA 2017-11/CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing
• MFSA 2017-11/CVE-2017-5441: Use-after-free with selection during scroll events
• MFSA 2017-11/CVE-2017-5459: Buffer overflow in WebGL

Mozilla NSS was updated to 3.29.5, bringing new features and fixing bugs:

• Update to NSS 3.29.5:

  • MFSA 2017-11/CVE-2017-5461: Rare crashes in the base 64 decoder and encoder were fixed.
  • MFSA 2017-11/CVE-2017-5462: A carry over bug in the RNG was fixed.
  • CVE-2016-9574: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA (bsc#1015499).
  • requires NSPR >= 4.13.1

• Update to NSS 3.29.3

  • enables TLS 1.3 by default

• Fixed a bug in hash computation (and build with GCC 7 which complains about shifts of boolean values). (bsc#1030071, bmo#1348767)

• Update to NSS 3.28.3

  This is a patch release to fix binary compatibility issues.

• Update to NSS 3.28.1

  This is a patch release to update the list of root CA certificates.

  • The following CA certificates were Removed

    CN = Buypass Class 2 CA 1 CN = Root CA Generalitat Valenciana OU = RSA Security 2048 V3

  • The following CA certificates were Added

    OU = AC RAIZ FNMT-RCM CN = Amazon Root CA 1 CN = Amazon Root CA 2 CN = Amazon Root CA 3 CN = Amazon Root CA 4 CN = LuxTrust Global Root 2 CN = Symantec Class 1 Public Primary Certification Authority - G4 CN = Symantec Class 1 Public Primary Certification Authority - G6 CN = Symantec Class 2 Public Primary Certification Authority - G4 CN = Symantec Class 2 Public Primary Certification Authority - G6

  • The version number of the updated root CA list has been set to 2.11

• Update to NSS 3.28

  New functionality:

  • NSS includes support for TLS 1.3 draft -18. This includes a number of improvements to TLS 1.3:

    • The signed certificate timestamp, used in certificate transparency, is supported in TLS 1.3.
    • Key exporters for TLS 1.3 are supported. This includes the early key exporter, which can be used if 0-RTT is…

Mozilla Firefox was updated to the Firefox ESR release 45.9.

Mozilla NSS was updated to support TLS 1.3 (close to release draft) and various new ciphers, PRFs, Diffie Hellman key agreement and support for more hashes.

Security issues fixed in Firefox (bsc#1035082)

• MFSA 2017-11/CVE-2017-5469: Potential Buffer overflow in flex-generated code
• MFSA 2017-11/CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1
• MFSA 2017-11/CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing
• MFSA 2017-11/CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing
• MFSA 2017-11/CVE-2017-5437: Vulnerabilities in Libevent library
• MFSA 2017-11/CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2
• MFSA 2017-11/CVE-2017-5435: Use-after-free during transaction processing in the editor
• MFSA 2017-11/CVE-2017-5434: Use-after-free during focus handling
• MFSA 2017-11/CVE-2017-5433: Use-after-free in SMIL animation functions
• MFSA 2017-11/CVE-2017-5432: Use-after-free in text input selection
• MFSA 2017-11/CVE-2017-5464: Memory corruption with accessibility and DOM manipulation
• MFSA 2017-11/CVE-2017-5465: Out-of-bounds read in ConvolvePixel
• MFSA 2017-11/CVE-2017-5460: Use-after-free in frame selection
• MFSA 2017-11/CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor
• MFSA 2017-11/CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data
• MFSA 2017-11/CVE-2017-5447: Out-of-bounds read during glyph processing
• MFSA 2017-11/CVE-2017-5444: Buffer overflow while parsing application/http-index-format content
• MFSA 2017-11/CVE-2017-5445: Uninitialized values used while parsing application/http-index-format content
• MFSA 2017-11/CVE-2017-5442: Use-after-free during style changes
• MFSA 2017-11/CVE-2017-5443: Out-of-bounds write during BinHex decoding
• MFSA 2017-11/CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing
• MFSA 2017-11/CVE-2017-5441: Use-after-free with selection during scroll events
• MFSA 2017-11/CVE-2017-5459: Buffer overflow in WebGL

Mozilla NSS was updated to 3.29.5, bringing new features and fixing bugs:

• Update to NSS 3.29.5:

  • MFSA 2017-11/CVE-2017-5461: Rare crashes in the base 64 decoder and encoder were fixed.
  • MFSA 2017-11/CVE-2017-5462: A carry over bug in the RNG was fixed.
  • CVE-2016-9574: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA (bsc#1015499).
  • requires NSPR >= 4.13.1

• Update to NSS 3.29.3

  • enables TLS 1.3 by default

• Fixed a bug in hash computation (and build with GCC 7 which complains about shifts of boolean values). (bsc#1030071, bmo#1348767)

• Update to NSS 3.28.3

  This is a patch release to fix binary compatibility issues.

• Update to NSS 3.28.1

  This is a patch release to update the list of root CA certificates.

  • The following CA certificates were Removed

    CN = Buypass Class 2 CA 1 CN = Root CA Generalitat Valenciana OU = RSA Security 2048 V3

  • The following CA certificates were Added

    OU = AC RAIZ FNMT-RCM CN = Amazon Root CA 1 CN = Amazon Root CA 2 CN = Amazon Root CA 3 CN = Amazon Root CA 4 CN = LuxTrust Global Root 2 CN = Symantec Class 1 Public Primary Certification Authority - G4 CN = Symantec Class 1 Public Primary Certification Authority - G6 CN = Symantec Class 2 Public Primary Certification Authority - G4 CN = Symantec Class 2 Public Primary Certification Authority - G6

  • The version number of the updated root CA list has been set to 2.11

• Update to NSS 3.28

  New functionality:

  • NSS includes support for TLS 1.3 draft -18. This includes a number of improvements to TLS 1.3:

    • The signed certificate timestamp, used in certificate transparency, is supported in TLS 1.3.
    • Key exporters for TLS 1.3 are supported. This includes the early key exporter, which can be used if 0-RTT is…

Christian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson, Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru Fujisawa discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2815, CVE-2016-2818)

A buffer overflow was discovered when parsing HTML5 fragments in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2819)

A use-after-free was discovered in contenteditable mode in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2821)

Jordi Chancel discovered a way to use a persistent menu within a <select> element and place this in an arbitrary location. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-2822)

Armin Razmdjou that the location.host property can be set to an arbitrary string after creating an invalid data: URI. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass some same-origin protections. (CVE-2016-2825)

A use-after-free was discovered when processing WebGL content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2828)

Tim McCormack discovered that the permissions notification can show the wrong icon when a page requests several permissions in quick succession. An attacker could potentially exploit this by tricking the user in to giving consent for access to the wrong resource. (CVE-2016-2829)

It was discovered that a pointerlock can be created in a fullscreen window without user consent in some circumstances, and this pointerlock cannot be cancelled without quitting Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service or conduct clickjacking attacks. (CVE-2016-2831)

John Schoenick discovered that CSS pseudo-classes can leak information about plugins that are installed but disabled. An attacker could potentially exploit this to fingerprint users. (CVE-2016-2832)

Matt Wobensmith discovered that Content Security Policy (CSP) does not block the loading of cross-domain Java applets when specified by policy. An attacker could potentially exploit this to bypass CSP protections and conduct cross-site scripting (XSS) attacks. (CVE-2016-2833)

In addition, multiple unspecified security issues were discovered in NSS. (CVE-2016-2834)

Tyson Smith and Jed Davis discovered that NSS incorrectly handled memory. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.

This update refreshes the NSS package to version 3.23 which includes the latest CA certificate bundle. As a security improvement, this update also modifies NSS behaviour to reject DH key sizes below 1024 bits, preventing a possible downgrade attack.