Security update for Mozilla Firefox SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:2735-1 Final 1 1 2016-11-05T10:09:48Z current 2016-11-05T10:09:48Z 2016-11-05T10:09:48Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for Mozilla Firefox Mozilla Firefox was updated to 49.0.2 to fix two security issues and some bugs. The following vulnerabilities were fixed: * CVE-2016-5287: Crash in nsTArray_base (bsc#1006475) * CVE-2016-5288: Web content can read cache entries (bsc#1006476) The following changes and fixes are included: * Asynchronous rendering of the Flash plugins is now enabled by default * Change D3D9 default fallback preference to prevent graphical artifacts * Network issue prevents some users from seeing the Firefox UI on startup * Web compatibility issue with file uploads * Web compatibility issue with Array.prototype.values * Diagnostic information on timing for tab switching * Fix a Canvas filters graphics issue affecting HTML5 apps The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2016-11/msg00015.html E-Mail link for openSUSE-SU-2016:2735-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings MozillaFirefox-49.0.2-128.1 MozillaFirefox-branding-upstream-49.0.2-128.1 MozillaFirefox-buildsymbols-49.0.2-128.1 MozillaFirefox-devel-49.0.2-128.1 MozillaFirefox-translations-common-49.0.2-128.1 MozillaFirefox-translations-other-49.0.2-128.1 A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox < 49.0.2. CVE-2016-5287 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-11/msg00015.html https://www.suse.com/security/cve/CVE-2016-5287.html CVE-2016-5287 https://bugzilla.suse.com/1006475 SUSE Bug 1006475 Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox < 49.0.2. CVE-2016-5288 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2016-11/msg00015.html https://www.suse.com/security/cve/CVE-2016-5288.html CVE-2016-5288 https://bugzilla.suse.com/1006476 SUSE Bug 1006476