openSUSE Security Update: MozillaFirefox: Update to version 15
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2012:1065-1
Rating:             critical
References:         #777588 
Cross-References:   CVE-2012-1956 CVE-2012-1970 CVE-2012-1972
                    CVE-2012-1973 CVE-2012-1974 CVE-2012-1975
                    CVE-2012-1976 CVE-2012-3956 CVE-2012-3957
                    CVE-2012-3958 CVE-2012-3959 CVE-2012-3960
                    CVE-2012-3961 CVE-2012-3962 CVE-2012-3963
                    CVE-2012-3964 CVE-2012-3965 CVE-2012-3966
                    CVE-2012-3967 CVE-2012-3968 CVE-2012-3969
                    CVE-2012-3970 CVE-2012-3971 CVE-2012-3972
                    CVE-2012-3973 CVE-2012-3975 CVE-2012-3976
                    CVE-2012-3978 CVE-2012-3980
Affected Products:
                    openSUSE 12.2
______________________________________________________________________________

   An update that fixes 29 vulnerabilities is now available.

Description:

   Mozilla Firefox, Thunderbird, xulrunner, seamonkey 15.0
   update (bnc#777588)
   * MFSA 2012-57/CVE-2012-1970 Miscellaneous memory safety
   hazards
   * MFSA
   2012-58/CVE-2012-1972/CVE-2012-1973/CVE-2012-1974/CVE-2012-1
   975
   CVE-2012-1976/CVE-2012-3956/CVE-2012-3957/CVE-2012-3958/CVE-
   2012-3959
   CVE-2012-3960/CVE-2012-3961/CVE-2012-3962/CVE-2012-3963/CVE-
   2012-3964 Use-after-free issues found using Address
   Sanitizer
   * MFSA 2012-59/CVE-2012-1956 (bmo#756719) Location object
   can be shadowed using Object.defineProperty
   * MFSA 2012-60/CVE-2012-3965 (bmo#769108) Escalation of
   privilege through about:newtab
   * MFSA 2012-61/CVE-2012-3966 (bmo#775794, bmo#775793)
   Memory corruption with bitmap format images with
   negative height
   * MFSA 2012-62/CVE-2012-3967/CVE-2012-3968 WebGL
   use-after-free and memory corruption
   * MFSA 2012-63/CVE-2012-3969/CVE-2012-3970 SVG buffer
   overflow and use-after-free issues
   * MFSA 2012-64/CVE-2012-3971 Graphite 2 memory corruption
   * MFSA 2012-65/CVE-2012-3972 (bmo#746855) Out-of-bounds
   read in format-number in XSLT
   * MFSA 2012-66/CVE-2012-3973 (bmo#757128) HTTPMonitor
   extension allows for remote debugging without explicit
   activation
   * MFSA 2012-68/CVE-2012-3975 (bmo#770684) DOMParser loads
   linked resources in extensions when parsing text/html
   * MFSA 2012-69/CVE-2012-3976 (bmo#768568) Incorrect site
   SSL certificate data display
   * MFSA 2012-70/CVE-2012-3978 (bmo#770429) Location object
   security checks bypassed by chrome code
   * MFSA 2012-72/CVE-2012-3980 (bmo#771859) Web console
   eval capable of executing chrome-privileged code
   - fix HTML5 video crash with GStreamer enabled (bmo#761030)
   - GStreamer is only used for MP4 (no WebM, OGG)
   - updated filelist
   - moved browser specific preferences to correct location


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 12.2:

      zypper in -t patch openSUSE-2012-538

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 12.2 (i586 x86_64):

      MozillaFirefox-15.0-2.7.1
      MozillaFirefox-branding-upstream-15.0-2.7.1
      MozillaFirefox-buildsymbols-15.0-2.7.1
      MozillaFirefox-debuginfo-15.0-2.7.1
      MozillaFirefox-debugsource-15.0-2.7.1
      MozillaFirefox-devel-15.0-2.7.1
      MozillaFirefox-translations-common-15.0-2.7.1
      MozillaFirefox-translations-other-15.0-2.7.1
      MozillaThunderbird-15.0-49.9.1
      MozillaThunderbird-buildsymbols-15.0-49.9.1
      MozillaThunderbird-debuginfo-15.0-49.9.1
      MozillaThunderbird-debugsource-15.0-49.9.1
      MozillaThunderbird-devel-15.0-49.9.1
      MozillaThunderbird-devel-debuginfo-15.0-49.9.1
      MozillaThunderbird-translations-common-15.0-49.9.1
      MozillaThunderbird-translations-other-15.0-49.9.1
      enigmail-1.4.4+15.0-49.9.1
      enigmail-debuginfo-1.4.4+15.0-49.9.1
      libfreebl3-3.13.6-2.7.1
      libfreebl3-debuginfo-3.13.6-2.7.1
      libsoftokn3-3.13.6-2.7.1
      libsoftokn3-debuginfo-3.13.6-2.7.1
      mozilla-js-15.0-2.8.1
      mozilla-js-debuginfo-15.0-2.8.1
      mozilla-nss-3.13.6-2.7.1
      mozilla-nss-certs-3.13.6-2.7.1
      mozilla-nss-certs-debuginfo-3.13.6-2.7.1
      mozilla-nss-debuginfo-3.13.6-2.7.1
      mozilla-nss-debugsource-3.13.6-2.7.1
      mozilla-nss-devel-3.13.6-2.7.1
      mozilla-nss-sysinit-3.13.6-2.7.1
      mozilla-nss-sysinit-debuginfo-3.13.6-2.7.1
      mozilla-nss-tools-3.13.6-2.7.1
      mozilla-nss-tools-debuginfo-3.13.6-2.7.1
      seamonkey-2.12-2.8.1
      seamonkey-debuginfo-2.12-2.8.1
      seamonkey-debugsource-2.12-2.8.1
      seamonkey-dom-inspector-2.12-2.8.1
      seamonkey-irc-2.12-2.8.1
      seamonkey-translations-common-2.12-2.8.1
      seamonkey-translations-other-2.12-2.8.1
      seamonkey-venkman-2.12-2.8.1
      xulrunner-15.0-2.8.1
      xulrunner-buildsymbols-15.0-2.8.1
      xulrunner-debuginfo-15.0-2.8.1
      xulrunner-debugsource-15.0-2.8.1
      xulrunner-devel-15.0-2.8.1
      xulrunner-devel-debuginfo-15.0-2.8.1

   - openSUSE 12.2 (x86_64):

      libfreebl3-32bit-3.13.6-2.7.1
      libfreebl3-debuginfo-32bit-3.13.6-2.7.1
      libsoftokn3-32bit-3.13.6-2.7.1
      libsoftokn3-debuginfo-32bit-3.13.6-2.7.1
      mozilla-js-32bit-15.0-2.8.1
      mozilla-js-debuginfo-32bit-15.0-2.8.1
      mozilla-nss-32bit-3.13.6-2.7.1
      mozilla-nss-certs-32bit-3.13.6-2.7.1
      mozilla-nss-certs-debuginfo-32bit-3.13.6-2.7.1
      mozilla-nss-debuginfo-32bit-3.13.6-2.7.1
      mozilla-nss-sysinit-32bit-3.13.6-2.7.1
      mozilla-nss-sysinit-debuginfo-32bit-3.13.6-2.7.1
      xulrunner-32bit-15.0-2.8.1
      xulrunner-debuginfo-32bit-15.0-2.8.1


References:

   https://www.suse.com/security/cve/CVE-2012-1956.html
   https://www.suse.com/security/cve/CVE-2012-1970.html
   https://www.suse.com/security/cve/CVE-2012-1972.html
   https://www.suse.com/security/cve/CVE-2012-1973.html
   https://www.suse.com/security/cve/CVE-2012-1974.html
   https://www.suse.com/security/cve/CVE-2012-1975.html
   https://www.suse.com/security/cve/CVE-2012-1976.html
   https://www.suse.com/security/cve/CVE-2012-3956.html
   https://www.suse.com/security/cve/CVE-2012-3957.html
   https://www.suse.com/security/cve/CVE-2012-3958.html
   https://www.suse.com/security/cve/CVE-2012-3959.html
   https://www.suse.com/security/cve/CVE-2012-3960.html
   https://www.suse.com/security/cve/CVE-2012-3961.html
   https://www.suse.com/security/cve/CVE-2012-3962.html
   https://www.suse.com/security/cve/CVE-2012-3963.html
   https://www.suse.com/security/cve/CVE-2012-3964.html
   https://www.suse.com/security/cve/CVE-2012-3965.html
   https://www.suse.com/security/cve/CVE-2012-3966.html
   https://www.suse.com/security/cve/CVE-2012-3967.html
   https://www.suse.com/security/cve/CVE-2012-3968.html
   https://www.suse.com/security/cve/CVE-2012-3969.html
   https://www.suse.com/security/cve/CVE-2012-3970.html
   https://www.suse.com/security/cve/CVE-2012-3971.html
   https://www.suse.com/security/cve/CVE-2012-3972.html
   https://www.suse.com/security/cve/CVE-2012-3973.html
   https://www.suse.com/security/cve/CVE-2012-3975.html
   https://www.suse.com/security/cve/CVE-2012-3976.html
   https://www.suse.com/security/cve/CVE-2012-3978.html
   https://www.suse.com/security/cve/CVE-2012-3980.html
   https://bugzilla.novell.com/777588