<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for Mozilla Firefox</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2016:2639-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2016-10-24T13:59:49Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2016-10-24T13:59:49Z</InitialReleaseDate>
    <CurrentReleaseDate>2016-10-24T13:59:49Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for Mozilla Firefox</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">Mozilla Firefox was updated to 49.0.2 to fix two security issues a some bugs.

The following vulnerabilities were fixed:

* CVE-2016-5287: Crash in nsTArray_base (bsc#1006475)
* CVE-2016-5288: Web content can read cache entries (bsc#1006476)

The following changes and fixes are included:

* Asynchronous rendering of the Flash plugins is now enabled by default
* Change D3D9 default fallback preference to prevent graphical artifacts
* Network issue prevents some users from seeing the Firefox UI on startup
* Web compatibility issue with file uploads
* Web compatibility issue with Array.prototype.values
* Diagnostic information on timing for tab switching
* Fix a Canvas filters graphics issue affecting HTML5 apps</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20162639-1/</URL>
      <Description>Link for SUSE-SU-2016:2639-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL/>
      <Description>E-Mail link for SUSE-SU-2016:2639-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 42.1">
      <Branch Type="Product Name" Name="openSUSE Leap 42.1">
        <FullProductName ProductID="openSUSE Leap 42.1">openSUSE Leap 42.1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-49.0.2-36.1">
      <FullProductName ProductID="MozillaFirefox-49.0.2-36.1">MozillaFirefox-49.0.2-36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-branding-upstream-49.0.2-36.1">
      <FullProductName ProductID="MozillaFirefox-branding-upstream-49.0.2-36.1">MozillaFirefox-branding-upstream-49.0.2-36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-buildsymbols-49.0.2-36.1">
      <FullProductName ProductID="MozillaFirefox-buildsymbols-49.0.2-36.1">MozillaFirefox-buildsymbols-49.0.2-36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-devel-49.0.2-36.1">
      <FullProductName ProductID="MozillaFirefox-devel-49.0.2-36.1">MozillaFirefox-devel-49.0.2-36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-translations-common-49.0.2-36.1">
      <FullProductName ProductID="MozillaFirefox-translations-common-49.0.2-36.1">MozillaFirefox-translations-common-49.0.2-36.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-translations-other-49.0.2-36.1">
      <FullProductName ProductID="MozillaFirefox-translations-other-49.0.2-36.1">MozillaFirefox-translations-other-49.0.2-36.1</FullProductName>
    </Branch>
    <Relationship ProductReference="MozillaFirefox-49.0.2-36.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-49.0.2-36.1">MozillaFirefox-49.0.2-36.1 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-branding-upstream-49.0.2-36.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-branding-upstream-49.0.2-36.1">MozillaFirefox-branding-upstream-49.0.2-36.1 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-buildsymbols-49.0.2-36.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-buildsymbols-49.0.2-36.1">MozillaFirefox-buildsymbols-49.0.2-36.1 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-devel-49.0.2-36.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-devel-49.0.2-36.1">MozillaFirefox-devel-49.0.2-36.1 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-translations-common-49.0.2-36.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-translations-common-49.0.2-36.1">MozillaFirefox-translations-common-49.0.2-36.1 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-translations-other-49.0.2-36.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-translations-other-49.0.2-36.1">MozillaFirefox-translations-other-49.0.2-36.1 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A potentially exploitable use-after-free crash during actor destruction with service workers. This issue does not affect releases earlier than Firefox 49. This vulnerability affects Firefox &lt; 49.0.2.</Note>
    </Notes>
    <CVE>CVE-2016-5287</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-branding-upstream-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-buildsymbols-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-devel-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-translations-common-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-translations-other-49.0.2-36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20162639-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-5287.html</URL>
        <Description>CVE-2016-5287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1006475</URL>
        <Description>SUSE Bug 1006475</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Web content could access information in the HTTP cache if e10s is disabled. This can reveal some visited URLs and the contents of those pages. This issue affects Firefox 48 and 49. This vulnerability affects Firefox &lt; 49.0.2.</Note>
    </Notes>
    <CVE>CVE-2016-5288</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-branding-upstream-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-buildsymbols-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-devel-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-translations-common-49.0.2-36.1</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-translations-other-49.0.2-36.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://www.suse.com/support/update/announcement/2016/suse-su-20162639-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2016-5288.html</URL>
        <Description>CVE-2016-5288</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1006476</URL>
        <Description>SUSE Bug 1006476</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
