SUSE-SU-2017:0427-1

    Dashboard / Vulnerabilities / SUSE-SU-2017:0427-1

    SUSE-SU-2017:0427-1

    Published: 8 Feb 2017Last Modified: 4 Feb 2026

    Summary: Security update for MozillaFirefox

    Details: MozillaFirefox 45 ESR was updated to 45.7 to fix the following issues (bsc#1021991): * MFSA 2017-02/CVE-2017-5378: Pointer and frame data leakage of Javascript objects (bsc#1021818) * MFSA 2017-02/CVE-2017-5396: Use-after-free with Media Decoder (bsc#1021821) * MFSA 2017-02/CVE-2017-5386: WebExtensions can use data: protocol to affect other extensions (bsc#1021823) * MFSA 2017-02/CVE-2017-5380: Potential use-after-free during DOM manipulations (bsc#1021819) * MFSA 2017-02/CVE-2017-5390: Insecure communication methods in Developer Tools JSON viewer (bsc#1021820) * MFSA 2017-02/CVE-2017-5373: Memory safety bugs fixed in Firefox 51 and Firefox ESR 45.7 (bsc#1021824) * MFSA 2017-02/CVE-2017-5375: Excessive JIT code allocation allows bypass of ASLR and DEP (bsc#1021814) * MFSA 2017-02/CVE-2017-5376: Use-after-free in XSL (bsc#1021817) * MFSA 2017-02/CVE-2017-5383: Location bar spoofing with unicode characters (bsc#1021822) Please see https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ for more information.

    References: https://www.suse.com/support/update/announcement/2017/suse-su-20170427-1/, https://bugzilla.suse.com/1021814, https://bugzilla.suse.com/1021817, https://bugzilla.suse.com/1021818, https://bugzilla.suse.com/1021819, https://bugzilla.suse.com/1021820, https://bugzilla.suse.com/1021821, https://bugzilla.suse.com/1021822, https://bugzilla.suse.com/1021823, https://bugzilla.suse.com/1021824, https://bugzilla.suse.com/1021991, https://www.suse.com/security/cve/CVE-2017-5373, https://www.suse.com/security/cve/CVE-2017-5375, https://www.suse.com/security/cve/CVE-2017-5376, https://www.suse.com/security/cve/CVE-2017-5378, https://www.suse.com/security/cve/CVE-2017-5380, https://www.suse.com/security/cve/CVE-2017-5383, https://www.suse.com/security/cve/CVE-2017-5386, https://www.suse.com/security/cve/CVE-2017-5390, https://www.suse.com/security/cve/CVE-2017-5396

    Affected packages

    Package

    Name: MozillaFirefox

    Purl: pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -45.7.0esr-99.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High