Oval Definition:oval:org.opensuse.security:def:56900
Revision Date:2020-12-01Version:1
Title:Security update for MozillaFirefox, MozillaFirefox-branding-SLE, llvm4, mozilla-nspr, mozilla-nss, apache2-mod_nss (Important)
Description:
This update for MozillaFirefox to ESR 60.2.2 fixes several issues.

These general changes are part of the version 60 release.

- New browser engine with speed improvements
- Redesigned graphical user interface elements
- Unified address and search bar for new installations
- New tab page listing top visited, recently visited and recommended pages
- Support for configuration policies in enterprise deployments via JSON files
- Support for Web Authentication, allowing the use of USB tokens for
authentication to web sites

The following changes affect compatibility:

- Now exclusively supports extensions built using the WebExtension API.
- Unsupported legacy extensions will no longer work in Firefox 60 ESR
- TLS certificates issued by Symantec before June 1st, 2016 are no longer trusted
The 'security.pki.distrust_ca_policy' preference can be set to 0 to reinstate
trust in those certificates

The following issues affect performance:

- new format for storing private keys, certificates and certificate trust
If the user home or data directory is on a network file system, it is
recommended that users set the following environment variable to avoid
slowdowns: NSS_SDB_USE_CACHE=yes
This setting is not recommended for local, fast file systems.

These security issues were fixed:

- CVE-2018-12381: Dragging and dropping Outlook email message results in page navigation (bsc#1107343).
- CVE-2017-16541: Proxy bypass using automount and autofs (bsc#1107343).
- CVE-2018-12376: Various memory safety bugs (bsc#1107343).
- CVE-2018-12377: Use-after-free in refresh driver timers (bsc#1107343).
- CVE-2018-12378: Use-after-free in IndexedDB (bsc#1107343).
- CVE-2018-12379: Out-of-bounds write with malicious MAR file (bsc#1107343).
- CVE-2018-12386: Type confusion in JavaScript allowed remote code execution (bsc#1110506)
- CVE-2018-12387: Array.prototype.push stack pointer vulnerability may enable exploits in the sandboxed content process (bsc#1110507)
- CVE-2018-12385: Crash in TransportSecurityInfo due to cached data (bsc#1109363)
- CVE-2018-12383: Setting a master password did not delete unencrypted previously stored passwords (bsc#1107343)

This update for mozilla-nspr to version 4.19 fixes the follwing issues

- Added TCP Fast Open functionality
- A socket without PR_NSPR_IO_LAYER will no longer trigger
an assertion when polling

This update for mozilla-nss to version 3.36.4 fixes the follwing issues

- Connecting to a server that was recently upgraded to TLS 1.3
would result in a SSL_RX_MALFORMED_SERVER_HELLO error.
- Fix a rare bug with PKCS#12 files.
- Replaces existing vectorized ChaCha20 code with verified
HACL* implementation.
- TLS 1.3 support has been updated to draft -23.
- Added formally verified implementations of non-vectorized Chacha20
and non-vectorized Poly1305 64-bit.
- The following CA certificates were Removed:
OU = Security Communication EV RootCA1
CN = CA Disig Root R1
CN = DST ACES CA X6
Certum CA, O=Unizeto Sp. z o.o.
StartCom Certification Authority
StartCom Certification Authority G2
T?BİTAK UEKAE K?k Sertifika Hizmet Sağlayıcısı - S?r?m 3
ACEDICOM Root
Certinomis - Autorit? Racine
T?RKTRUST Elektronik Sertifika Hizmet Sağlayıcısı
PSCProcert
CA 沃通根证书, O=WoSign CA Limited
Certification Authority of WoSign
Certification Authority of WoSign G2
CA WoSign ECC Root
Subject CN = VeriSign Class 3 Secure Server CA - G2
O = Japanese Government, OU = ApplicationCA
CN = WellsSecure Public Root Certificate Authority
CN = T?RKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H6
CN = Microsec e-Szigno Root
* The following CA certificates were Removed:
AddTrust Public CA Root
AddTrust Qualified CA Root
China Internet Network Information Center EV Certificates Root
CNNIC ROOT
ComSign Secured CA
GeoTrust Global CA 2
Secure Certificate Services
Swisscom Root CA 1
Swisscom Root EV CA 2
Trusted Certificate Services
UTN-USERFirst-Hardware
UTN-USERFirst-Object
* The following CA certificates were Added
CN = D-TRUST Root CA 3 2013
CN = TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1
GDCA TrustAUTH R5 ROOT
SSL.com Root Certification Authority RSA
SSL.com Root Certification Authority ECC
SSL.com EV Root Certification Authority RSA R2
SSL.com EV Root Certification Authority ECC
TrustCor RootCert CA-1
TrustCor RootCert CA-2
TrustCor ECA-1
* The Websites (TLS/SSL) trust bit was turned off for the following
CA certificates:
CN = Chambers of Commerce Root
CN = Global Chambersign Root
* TLS servers are able to handle a ClientHello statelessly, if the
client supports TLS 1.3. If the server sends a HelloRetryRequest,
it is possible to discard the server socket, and make a new socket
to handle any subsequent ClientHello. This better enables stateless
server operation. (This feature is added in support of QUIC, but it
also has utility for DTLS 1.3 servers.)

Due to the update of mozilla-nss apache2-mod_nss needs to be updated to
change to the SQLite certificate database, which is now the default (bsc#1108771)
Family:unixClass:patch
Status:Reference(s):1002981
1010735
1010740
1010752
1010754
1010911
1012260
1014136
1021577
1021739
1024989
1025913
1026191
1026236
1026507
1027519
1027692
1027998
1031460
1033936
1033937
1033938
1033939
1033940
1033941
1033942
1033943
1033944
1033945
1034845
1035082
1036470
1037243
1040311
1040312
1040313
1041469
1041894
1042160
1042863
1042882
1042893
1042915
1042923
1042924
1042931
1042938
1043074
1043297
1043960
1044337
1049703
1050577
1050578
1050579
1050581
1052311
1052368
1053153
1055960
1061204
1064786
1065464
1066489
1069708
1073210
1078436
1089811
1091551
1092697
1094767
1096515
1107343
1108771
1108986
1109363
1109465
1110506
1110507
1111647
1116451
1121874
1123131
1123455
1124062
1124869
1127760
1127857
1128845
1135189
1135228
1167068
1170558
1171363
1172265
682920
703591
839074
857131
893359
906574
924960
933288
933878
936227
938913
942865
957566
957567
957598
957600
960837
964844
971741
972127
990856
998761
998762
998763
998800
998963
998964
CVE-2011-2895
CVE-2013-6393
CVE-2013-6462
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
CVE-2014-2525
CVE-2014-8964
CVE-2014-9130
CVE-2015-1802
CVE-2015-1803
CVE-2015-1804
CVE-2015-2325
CVE-2015-2327
CVE-2015-2328
CVE-2015-3210
CVE-2015-3217
CVE-2015-4000
CVE-2015-5073
CVE-2015-8380
CVE-2015-8381
CVE-2015-8382
CVE-2015-8383
CVE-2015-8384
CVE-2015-8385
CVE-2015-8386
CVE-2015-8387
CVE-2015-8388
CVE-2015-8389
CVE-2015-8390
CVE-2015-8391
CVE-2015-8392
CVE-2015-8393
CVE-2015-8394
CVE-2015-8395
CVE-2016-10196
CVE-2016-1283
CVE-2016-3191
CVE-2016-6354
CVE-2016-7175
CVE-2016-7176
CVE-2016-7177
CVE-2016-7178
CVE-2016-7179
CVE-2016-7180
CVE-2016-9373
CVE-2016-9374
CVE-2016-9375
CVE-2016-9376
CVE-2017-0663
CVE-2017-1000112
CVE-2017-10661
CVE-2017-10911
CVE-2017-10912
CVE-2017-10913
CVE-2017-10914
CVE-2017-10915
CVE-2017-10916
CVE-2017-10917
CVE-2017-10918
CVE-2017-10920
CVE-2017-10921
CVE-2017-10922
CVE-2017-11624
CVE-2017-11625
CVE-2017-11626
CVE-2017-11627
CVE-2017-12595
CVE-2017-16541
CVE-2017-16939
CVE-2017-5429
CVE-2017-5430
CVE-2017-5432
CVE-2017-5433
CVE-2017-5434
CVE-2017-5435
CVE-2017-5436
CVE-2017-5438
CVE-2017-5439
CVE-2017-5440
CVE-2017-5441
CVE-2017-5442
CVE-2017-5443
CVE-2017-5444
CVE-2017-5445
CVE-2017-5446
CVE-2017-5447
CVE-2017-5448
CVE-2017-5449
CVE-2017-5451
CVE-2017-5454
CVE-2017-5455
CVE-2017-5456
CVE-2017-5459
CVE-2017-5460
CVE-2017-5461
CVE-2017-5462
CVE-2017-5464
CVE-2017-5465
CVE-2017-5466
CVE-2017-5467
CVE-2017-5469
CVE-2017-5470
CVE-2017-5472
CVE-2017-5596
CVE-2017-5597
CVE-2017-5969
CVE-2017-6014
CVE-2017-7700
CVE-2017-7701
CVE-2017-7702
CVE-2017-7703
CVE-2017-7704
CVE-2017-7705
CVE-2017-7745
CVE-2017-7746
CVE-2017-7747
CVE-2017-7748
CVE-2017-7749
CVE-2017-7750
CVE-2017-7751
CVE-2017-7752
CVE-2017-7754
CVE-2017-7755
CVE-2017-7756
CVE-2017-7757
CVE-2017-7758
CVE-2017-7761
CVE-2017-7763
CVE-2017-7764
CVE-2017-7765
CVE-2017-7768
CVE-2017-7778
CVE-2017-8112
CVE-2017-8309
CVE-2017-8905
CVE-2017-9103
CVE-2017-9104
CVE-2017-9105
CVE-2017-9106
CVE-2017-9107
CVE-2017-9108
CVE-2017-9109
CVE-2017-9208
CVE-2017-9209
CVE-2017-9210
CVE-2017-9330
CVE-2017-9374
CVE-2017-9503
CVE-2018-12086
CVE-2018-12376
CVE-2018-12377
CVE-2018-12378
CVE-2018-12379
CVE-2018-12381
CVE-2018-12383
CVE-2018-12385
CVE-2018-12386
CVE-2018-12387
CVE-2018-16858
CVE-2018-18227
CVE-2020-12108
CVE-2020-12137
SUSE-SU-2016:0344-1
SUSE-SU-2016:3161-1
SUSE-SU-2017:1442-1
SUSE-SU-2017:1669-1
SUSE-SU-2017:1670-1
SUSE-SU-2017:1812-1
SUSE-SU-2017:2423-1
SUSE-SU-2017:3316-1
SUSE-SU-2018:3066-1
SUSE-SU-2018:3590-1
SUSE-SU-2018:3591-2
SUSE-SU-2019:1448-1
SUSE-SU-2020:1301-1
SUSE-SU-2020:1612-1
Platform(s):openSUSE Leap 15.0
openSUSE Leap 15.1
SUSE Linux Enterprise Desktop 12 SP4
SUSE Linux Enterprise Server 12 SP1
SUSE Linux Enterprise Server 12 SP1-LTSS
SUSE Linux Enterprise Server 12 SP2
SUSE Linux Enterprise Server 12 SP2-BCL
SUSE Linux Enterprise Server 12 SP2-ESPOS
SUSE Linux Enterprise Server 12 SP2-LTSS
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-ESPOS
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP3-TERADATA
SUSE Linux Enterprise Server 12 SP4
SUSE OpenStack Cloud 7
SUSE OpenStack Cloud 8
SUSE OpenStack Cloud Crowbar 8
Product(s):
Definition Synopsis
  • openSUSE Leap 15.0 is installed
  • AND Package Information
  • lame-3.100-lp150.1 is installed
  • OR libmp3lame0-3.100-lp150.1 is installed
    • Definition Synopsis
  • openSUSE Leap 15.1 is installed
  • AND Package Information
  • libwireshark9-2.4.15-lp151.2.3 is installed
  • OR libwiretap7-2.4.15-lp151.2.3 is installed
  • OR libwscodecs1-2.4.15-lp151.2.3 is installed
  • OR libwsutil8-2.4.15-lp151.2.3 is installed
  • OR wireshark-2.4.15-lp151.2.3 is installed
  • OR wireshark-devel-2.4.15-lp151.2.3 is installed
  • OR wireshark-ui-qt-2.4.15-lp151.2.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP4 is installed
  • AND Package Information
  • MozillaFirefox-60.2.2esr-109.46 is installed
  • OR MozillaFirefox-branding-SLE-60-32.3 is installed
  • OR MozillaFirefox-translations-common-60.2.2esr-109.46 is installed
  • OR libfreebl3-3.36.4-58.15 is installed
  • OR libfreebl3-32bit-3.36.4-58.15 is installed
  • OR libsoftokn3-3.36.4-58.15 is installed
  • OR libsoftokn3-32bit-3.36.4-58.15 is installed
  • OR mozilla-nspr-4.19-19.3 is installed
  • OR mozilla-nspr-32bit-4.19-19.3 is installed
  • OR mozilla-nss-3.36.4-58.15 is installed
  • OR mozilla-nss-32bit-3.36.4-58.15 is installed
  • OR mozilla-nss-certs-3.36.4-58.15 is installed
  • OR mozilla-nss-certs-32bit-3.36.4-58.15 is installed
  • OR mozilla-nss-sysinit-3.36.4-58.15 is installed
  • OR mozilla-nss-sysinit-32bit-3.36.4-58.15 is installed
  • OR mozilla-nss-tools-3.36.4-58.15 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1 is installed
  • AND socat-1.7.2.4-3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1-LTSS is installed
  • AND Package Information
  • xen-4.5.5_12-22.18 is installed
  • OR xen-doc-html-4.5.5_12-22.18 is installed
  • OR xen-kmp-default-4.5.5_12_k3.12.74_60.64.45-22.18 is installed
  • OR xen-libs-4.5.5_12-22.18 is installed
  • OR xen-libs-32bit-4.5.5_12-22.18 is installed
  • OR xen-tools-4.5.5_12-22.18 is installed
  • OR xen-tools-domU-4.5.5_12-22.18 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2 is installed
  • AND libXfont1-1.5.1-10 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-BCL is installed
  • AND Package Information
  • libsystemd0-228-150.53 is installed
  • OR libsystemd0-32bit-228-150.53 is installed
  • OR libudev1-228-150.53 is installed
  • OR libudev1-32bit-228-150.53 is installed
  • OR systemd-228-150.53 is installed
  • OR systemd-32bit-228-150.53 is installed
  • OR systemd-bash-completion-228-150.53 is installed
  • OR systemd-sysvinit-228-150.53 is installed
  • OR udev-228-150.53 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-ESPOS is installed
  • AND Package Information
  • kernel-default-4.4.121-92.85 is installed
  • OR kernel-default-base-4.4.121-92.85 is installed
  • OR kernel-default-devel-4.4.121-92.85 is installed
  • OR kernel-devel-4.4.121-92.85 is installed
  • OR kernel-macros-4.4.121-92.85 is installed
  • OR kernel-source-4.4.121-92.85 is installed
  • OR kernel-syms-4.4.121-92.85 is installed
  • OR kgraft-patch-4_4_121-92_85-default-1-3.5 is installed
  • OR kgraft-patch-SLE12-SP2_Update_23-1-3.5 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-LTSS is installed
  • AND Package Information
  • kgraft-patch-4_4_103-92_53-default-7-2 is installed
  • OR kgraft-patch-SLE12-SP2_Update_16-7-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3 is installed
  • AND busybox-1.21.1-3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-BCL is installed
  • AND Package Information
  • java-1_7_1-ibm-1.7.1_sr4.60-38.47 is installed
  • OR java-1_7_1-ibm-alsa-1.7.1_sr4.60-38.47 is installed
  • OR java-1_7_1-ibm-devel-1.7.1_sr4.60-38.47 is installed
  • OR java-1_7_1-ibm-jdbc-1.7.1_sr4.60-38.47 is installed
  • OR java-1_7_1-ibm-plugin-1.7.1_sr4.60-38.47 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
  • AND Package Information
  • ceph-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR ceph-common-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR libcephfs2-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR librados2-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR libradosstriper1-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR librbd1-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR librgw2-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR python-cephfs-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR python-rados-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR python-rbd-12.2.12+git.1587570958.35d78d0243-2.45 is installed
  • OR python-rgw-12.2.12+git.1587570958.35d78d0243-2.45 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-LTSS is installed
  • AND Package Information
  • libpython3_4m1_0-3.4.10-25.45 is installed
  • OR python3-3.4.10-25.45 is installed
  • OR python3-base-3.4.10-25.45 is installed
  • OR python3-curses-3.4.10-25.45 is installed
  • OR python3-devel-3.4.10-25.45 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
  • AND libcares2-1.9.1-9.4 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4 is installed
  • AND perl-HTML-Parser-3.71-1 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 7 is installed
  • AND Package Information
  • libwireshark9-2.4.10-48.32 is installed
  • OR libwiretap7-2.4.10-48.32 is installed
  • OR libwscodecs1-2.4.10-48.32 is installed
  • OR libwsutil8-2.4.10-48.32 is installed
  • OR wireshark-2.4.10-48.32 is installed
  • OR wireshark-gtk-2.4.10-48.32 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 8 is installed
  • AND Package Information
  • apache2-2.4.23-29.54 is installed
  • OR apache2-doc-2.4.23-29.54 is installed
  • OR apache2-example-pages-2.4.23-29.54 is installed
  • OR apache2-prefork-2.4.23-29.54 is installed
  • OR apache2-utils-2.4.23-29.54 is installed
  • OR apache2-worker-2.4.23-29.54 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud Crowbar 8 is installed
  • AND nodejs6-6.14.4-11.18 is installed
    • BACK