<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for MozillaFirefox</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2016:0007-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2016-01-03T17:35:34Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2016-01-03T17:35:34Z</InitialReleaseDate>
    <CurrentReleaseDate>2016-01-03T17:35:34Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for MozillaFirefox</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update to MozillaFirefox 43.0.3 fixes the following issues:

* CVE-2015-7575: MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature, in combination wit NSS 3.20.2 [boo#959888]

Further fixes:

* workaround Youtube user agent detection issue (bmo#1233970)
* fix file download regression for multi user systems
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html</URL>
      <Description>E-Mail link for openSUSE-SU-2016:0007-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 42.1">
      <Branch Type="Product Name" Name="openSUSE Leap 42.1">
        <FullProductName ProductID="openSUSE Leap 42.1">openSUSE Leap 42.1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-43.0.3-9.2">
      <FullProductName ProductID="MozillaFirefox-43.0.3-9.2">MozillaFirefox-43.0.3-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-branding-upstream-43.0.3-9.2">
      <FullProductName ProductID="MozillaFirefox-branding-upstream-43.0.3-9.2">MozillaFirefox-branding-upstream-43.0.3-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-buildsymbols-43.0.3-9.2">
      <FullProductName ProductID="MozillaFirefox-buildsymbols-43.0.3-9.2">MozillaFirefox-buildsymbols-43.0.3-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-devel-43.0.3-9.2">
      <FullProductName ProductID="MozillaFirefox-devel-43.0.3-9.2">MozillaFirefox-devel-43.0.3-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-translations-common-43.0.3-9.2">
      <FullProductName ProductID="MozillaFirefox-translations-common-43.0.3-9.2">MozillaFirefox-translations-common-43.0.3-9.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="MozillaFirefox-translations-other-43.0.3-9.2">
      <FullProductName ProductID="MozillaFirefox-translations-other-43.0.3-9.2">MozillaFirefox-translations-other-43.0.3-9.2</FullProductName>
    </Branch>
    <Relationship ProductReference="MozillaFirefox-43.0.3-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-43.0.3-9.2">MozillaFirefox-43.0.3-9.2 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-branding-upstream-43.0.3-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-branding-upstream-43.0.3-9.2">MozillaFirefox-branding-upstream-43.0.3-9.2 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-buildsymbols-43.0.3-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-buildsymbols-43.0.3-9.2">MozillaFirefox-buildsymbols-43.0.3-9.2 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-devel-43.0.3-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-devel-43.0.3-9.2">MozillaFirefox-devel-43.0.3-9.2 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-translations-common-43.0.3-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-translations-common-43.0.3-9.2">MozillaFirefox-translations-common-43.0.3-9.2 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="MozillaFirefox-translations-other-43.0.3-9.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.1">
      <FullProductName ProductID="openSUSE Leap 42.1:MozillaFirefox-translations-other-43.0.3-9.2">MozillaFirefox-translations-other-43.0.3-9.2 as a component of openSUSE Leap 42.1</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.</Note>
    </Notes>
    <CVE>CVE-2015-7575</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-43.0.3-9.2</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-branding-upstream-43.0.3-9.2</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-buildsymbols-43.0.3-9.2</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-devel-43.0.3-9.2</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-translations-common-43.0.3-9.2</ProductID>
        <ProductID>openSUSE Leap 42.1:MozillaFirefox-translations-other-43.0.3-9.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2015-7575.html</URL>
        <Description>CVE-2015-7575</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/959888</URL>
        <Description>SUSE Bug 959888</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/960402</URL>
        <Description>SUSE Bug 960402</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/960996</URL>
        <Description>SUSE Bug 960996</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961280</URL>
        <Description>SUSE Bug 961280</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961281</URL>
        <Description>SUSE Bug 961281</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961282</URL>
        <Description>SUSE Bug 961282</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961283</URL>
        <Description>SUSE Bug 961283</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961284</URL>
        <Description>SUSE Bug 961284</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961290</URL>
        <Description>SUSE Bug 961290</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/961357</URL>
        <Description>SUSE Bug 961357</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/962743</URL>
        <Description>SUSE Bug 962743</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/963937</URL>
        <Description>SUSE Bug 963937</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/967521</URL>
        <Description>SUSE Bug 967521</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/981087</URL>
        <Description>SUSE Bug 981087</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
