<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for MozillaFirefox, MozillaThunderbird, mozilla-nspr</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2015:0677-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2015-04-07T19:58:43Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2015-04-07T19:58:43Z</InitialReleaseDate>
    <CurrentReleaseDate>2015-04-07T19:58:43Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for MozillaFirefox, MozillaThunderbird, mozilla-nspr</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">Mozilla Firefox and Thunderbird were updated to fix several important vulnerabilities.

Mozilla Firefox was updated to 37.0.1.
Mozilla Thunderbird was updated to 31.6.0.
mozilla-nspr was updated to 4.10.8 as a dependency.

The following vulnerabilities were fixed in Mozilla Firefox:
 
* Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815 boo#925392)
* Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813 bmo#1106596 boo#925393)
* Add-on lightweight theme installation approval bypassed through MITM attack (MFSA 2015-32/CVE-2015-0812 bmo#1128126 boo#925394)
* resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816 bmo#1144991 boo#925395)
* Out of bounds read in QCMS library (MFSA-2015-34/CVE-2015-0811 bmo#1132468 boo#925396)
* Incorrect memory management for simple-type arrays in WebRTC (MFSA-2015-36/CVE-2015-0808 bmo#1109552 boo#925397)
* CORS requests should not follow 30x redirections after preflight (MFSA-2015-37/CVE-2015-0807 bmo#1111834 boo#925398)
* Memory corruption crashes in Off Main Thread Compositing (MFSA-2015-38/CVE-2015-0805/CVE-2015-0806 bmo#1135511 bmo#1099437 boo#925399)
* Use-after-free due to type confusion flaws (MFSA-2015-39/CVE-2015-0803/CVE-2015-0804 (mo#1134560 boo#925400)
* Same-origin bypass through anchor navigation (MFSA-2015-40/CVE-2015-0801 bmo#1146339 boo#925401)
* Windows can retain access to privileged content on navigation to unprivileged pages (MFSA-2015-42/CVE-2015-0802 bmo#1124898 boo#925402)

The following vulnerability was fixed in functionality that was not released as an update to openSUSE:

* Certificate verification could be bypassed through the HTTP/2 Alt-Svc header (MFSA 2015-44/CVE-2015-0799 bmo#1148328 bnc#926166)

The functionality added in 37.0 and thus removed in 37.0.1 was:

* Opportunistically encrypt HTTP traffic where the server supports
  HTTP/2 AltSvc

The following functionality was added or updated in Mozilla Firefox:

  * Heartbeat user rating system
  * Yandex set as default search provider for the Turkish locale
  * Bing search now uses HTTPS for secure searching
  * Improved protection against site impersonation via OneCRL
    centralized certificate revocation
  * some more behaviour changes for TLS

The following vulnerabilities were fixed in Mozilla Thunderbird:

* Miscellaneous memory safety hazards (MFSA 2015-30/CVE-2015-0814/CVE-2015-0815 boo#925392)
* Use-after-free when using the Fluendo MP3 GStreamer plugin (MFSA 2015-31/CVE-2015-0813 bmo#1106596 boo#925393)
* resource:// documents can load privileged pages (MFSA 2015-33/CVE-2015-0816 bmo#1144991 boo#925395)
* CORS requests should not follow 30x redirections after preflight (MFSA-2015-37/CVE-2015-0807 bmo#1111834 boo#925398)
* Same-origin bypass through anchor navigation (MFSA-2015-40/CVE-2015-0801 bmo#1146339 boo#925401)

mozilla-nspr was updated to 4.10.8 as a dependency and received the following changes:
  * bmo#573192: remove the stack-based PRFileDesc cache.
  * bmo#756047: check for _POSIX_THREAD_PRIORITY_SCHEDULING &gt; 0 instead of only checking if the identifier is defined.
  * bmo#1089908: Fix variable shadowing in _PR_MD_LOCKFILE. Use PR_ARRAY_SIZE to get the array size of _PR_RUNQ(t-&gt;cpu).
  * bmo#1106600: Replace PR_ASSERT(!'foo') with PR_NOT_REACHED('foo') to fix clang -Wstring-conversion warnings.
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      <Description>E-Mail link for openSUSE-SU-2015:0677-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Version" Name="MozillaFirefox-37.0.1-68.1">
      <FullProductName ProductID="MozillaFirefox-37.0.1-68.1">MozillaFirefox-37.0.1-68.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-branding-upstream-37.0.1-68.1">
      <FullProductName ProductID="MozillaFirefox-branding-upstream-37.0.1-68.1">MozillaFirefox-branding-upstream-37.0.1-68.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-buildsymbols-37.0.1-68.1">
      <FullProductName ProductID="MozillaFirefox-buildsymbols-37.0.1-68.1">MozillaFirefox-buildsymbols-37.0.1-68.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-devel-37.0.1-68.1">
      <FullProductName ProductID="MozillaFirefox-devel-37.0.1-68.1">MozillaFirefox-devel-37.0.1-68.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-translations-common-37.0.1-68.1">
      <FullProductName ProductID="MozillaFirefox-translations-common-37.0.1-68.1">MozillaFirefox-translations-common-37.0.1-68.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-translations-other-37.0.1-68.1">
      <FullProductName ProductID="MozillaFirefox-translations-other-37.0.1-68.1">MozillaFirefox-translations-other-37.0.1-68.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-31.6.0-70.50.2">
      <FullProductName ProductID="MozillaThunderbird-31.6.0-70.50.2">MozillaThunderbird-31.6.0-70.50.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-buildsymbols-31.6.0-70.50.2">
      <FullProductName ProductID="MozillaThunderbird-buildsymbols-31.6.0-70.50.2">MozillaThunderbird-buildsymbols-31.6.0-70.50.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-devel-31.6.0-70.50.2">
      <FullProductName ProductID="MozillaThunderbird-devel-31.6.0-70.50.2">MozillaThunderbird-devel-31.6.0-70.50.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-translations-common-31.6.0-70.50.2">
      <FullProductName ProductID="MozillaThunderbird-translations-common-31.6.0-70.50.2">MozillaThunderbird-translations-common-31.6.0-70.50.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaThunderbird-translations-other-31.6.0-70.50.2">
      <FullProductName ProductID="MozillaThunderbird-translations-other-31.6.0-70.50.2">MozillaThunderbird-translations-other-31.6.0-70.50.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mozilla-nspr-4.10.8-22.1">
      <FullProductName ProductID="mozilla-nspr-4.10.8-22.1">mozilla-nspr-4.10.8-22.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mozilla-nspr-32bit-4.10.8-22.1">
      <FullProductName ProductID="mozilla-nspr-32bit-4.10.8-22.1">mozilla-nspr-32bit-4.10.8-22.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="mozilla-nspr-devel-4.10.8-22.1">
      <FullProductName ProductID="mozilla-nspr-devel-4.10.8-22.1">mozilla-nspr-devel-4.10.8-22.1</FullProductName>
    </Branch>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header.</Note>
    </Notes>
    <CVE>CVE-2015-0799</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0799.html</URL>
        <Description>CVE-2015-0799</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/926166</URL>
        <Description>SUSE Bug 926166</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.</Note>
    </Notes>
    <CVE>CVE-2015-0801</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0801.html</URL>
        <Description>CVE-2015-0801</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925401</URL>
        <Description>SUSE Bug 925401</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.</Note>
    </Notes>
    <CVE>CVE-2015-0802</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0802.html</URL>
        <Description>CVE-2015-0802</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925402</URL>
        <Description>SUSE Bug 925402</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.</Note>
    </Notes>
    <CVE>CVE-2015-0803</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0803.html</URL>
        <Description>CVE-2015-0803</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925400</URL>
        <Description>SUSE Bug 925400</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element.</Note>
    </Notes>
    <CVE>CVE-2015-0804</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0804.html</URL>
        <Description>CVE-2015-0804</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925400</URL>
        <Description>SUSE Bug 925400</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.</Note>
    </Notes>
    <CVE>CVE-2015-0805</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0805.html</URL>
        <Description>CVE-2015-0805</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925399</URL>
        <Description>SUSE Bug 925399</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content.</Note>
    </Notes>
    <CVE>CVE-2015-0806</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0806.html</URL>
        <Description>CVE-2015-0806</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925399</URL>
        <Description>SUSE Bug 925399</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="8">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638.</Note>
    </Notes>
    <CVE>CVE-2015-0807</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0807.html</URL>
        <Description>CVE-2015-0807</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/913068</URL>
        <Description>SUSE Bug 913068</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925398</URL>
        <Description>SUSE Bug 925398</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="9">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors.</Note>
    </Notes>
    <CVE>CVE-2015-0808</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0808.html</URL>
        <Description>CVE-2015-0808</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925397</URL>
        <Description>SUSE Bug 925397</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="10">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.</Note>
    </Notes>
    <CVE>CVE-2015-0811</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.4</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:N/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0811.html</URL>
        <Description>CVE-2015-0811</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925396</URL>
        <Description>SUSE Bug 925396</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="11">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain.</Note>
    </Notes>
    <CVE>CVE-2015-0812</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0812.html</URL>
        <Description>CVE-2015-0812</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925394</URL>
        <Description>SUSE Bug 925394</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="12">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file.</Note>
    </Notes>
    <CVE>CVE-2015-0813</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.1</BaseScoreV2>
        <VectorV2>AV:N/AC:H/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0813.html</URL>
        <Description>CVE-2015-0813</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925393</URL>
        <Description>SUSE Bug 925393</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="13">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</Note>
    </Notes>
    <CVE>CVE-2015-0814</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0814.html</URL>
        <Description>CVE-2015-0814</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925392</URL>
        <Description>SUSE Bug 925392</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="14">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.</Note>
    </Notes>
    <CVE>CVE-2015-0815</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0815.html</URL>
        <Description>CVE-2015-0815</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925392</URL>
        <Description>SUSE Bug 925392</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="15">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js.</Note>
    </Notes>
    <CVE>CVE-2015-0816</CVE>
    <ProductStatuses>
      <Status Type="Fixed"/>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2015-04/msg00003.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-0816.html</URL>
        <Description>CVE-2015-0816</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925368</URL>
        <Description>SUSE Bug 925368</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/925395</URL>
        <Description>SUSE Bug 925395</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
