Upstream information

CVE-2016-2839 at MITRE

Description

Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo _cairo_surface_get_extents calls that do not properly interact with libav header allocation in FFmpeg 0.10, which allows remote attackers to cause a denial of service (application crash) via a crafted video.

SUSE information

CVSS v2 Scores
  National Vulnerability Database SUSE
Base Score 4.30 6.82
Vector AV:N/AC:M/Au:N/C:N/I:N/A:P AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network Network
Access Complexity Medium Medium
Authentication None None
Confidentiality Impact None Partial
Integrity Impact None Partial
Availability Impact Partial Partial
CVSS v3 Scores
  National Vulnerability Database
Base Score 6.5
Vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Access Vector Network
Access Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
SUSE Bugzilla entry: 991809 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Linux Enterprise Desktop 12 SP1
  • MozillaFirefox >= 45.3.0esr-78.1
  • MozillaFirefox-translations >= 45.3.0esr-78.1
Patchnames:
SUSE-SLE-DESKTOP-12-SP1-2016-1254
SUSE Linux Enterprise Desktop 12 SP2
  • MozillaFirefox >= 45.4.0esr-81.1
  • MozillaFirefox-translations >= 45.4.0esr-81.1
Patchnames:
SUSE Linux Enterprise Desktop 12 SP2 GA MozillaFirefox
SUSE Linux Enterprise Point of Sale 11 SP3
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-translations >= 45.3.0esr-50.1
Patchnames:
sleposp3-MozillaFirefox-12722
SUSE Linux Enterprise Server 11 SP2-LTSS
  • MozillaFirefox >= 45.3.0esr-48.1
  • MozillaFirefox-branding-SLED >= 45.0-20.38
  • MozillaFirefox-translations >= 45.3.0esr-48.1
  • firefox-fontconfig >= 2.11.0-4.2
  • libfreebl3 >= 3.21.1-26.2
  • libfreebl3-32bit >= 3.21.1-26.2
  • mozilla-nspr >= 4.12-25.2
  • mozilla-nspr-32bit >= 4.12-25.2
  • mozilla-nspr-devel >= 4.12-25.2
  • mozilla-nss >= 3.21.1-26.2
  • mozilla-nss-32bit >= 3.21.1-26.2
  • mozilla-nss-devel >= 3.21.1-26.2
  • mozilla-nss-tools >= 3.21.1-26.2
Patchnames:
slessp2-MozillaFirefox-12690
SUSE Linux Enterprise Server 11 SP3-LTSS
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-translations >= 45.3.0esr-50.1
Patchnames:
slessp3-MozillaFirefox-12722
SUSE Linux Enterprise Server 11 SP4
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-translations >= 45.3.0esr-50.1
Patchnames:
slessp4-MozillaFirefox-12722
SUSE Linux Enterprise Server 12 SP1
  • MozillaFirefox >= 45.3.0esr-78.1
  • MozillaFirefox-translations >= 45.3.0esr-78.1
Patchnames:
SUSE-SLE-SERVER-12-SP1-2016-1254
SUSE Linux Enterprise Server 12 SP2
  • MozillaFirefox >= 45.4.0esr-81.1
  • MozillaFirefox-translations >= 45.4.0esr-81.1
Patchnames:
SUSE Linux Enterprise Server 12 SP2 GA MozillaFirefox
SUSE Linux Enterprise Server 12-LTSS
  • MozillaFirefox >= 45.3.0esr-78.1
  • MozillaFirefox-translations >= 45.3.0esr-78.1
Patchnames:
SUSE-SLE-SERVER-12-2016-1254
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2
  • MozillaFirefox >= 45.4.0esr-81.1
  • MozillaFirefox-translations >= 45.4.0esr-81.1
Patchnames:
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 GA MozillaFirefox
SUSE Linux Enterprise Software Development Kit 11 SP4
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-devel >= 45.3.0esr-50.1
Patchnames:
sdksp4-MozillaFirefox-12722
SUSE Linux Enterprise Software Development Kit 12 SP1
  • MozillaFirefox >= 45.3.0esr-78.1
  • MozillaFirefox-devel >= 45.3.0esr-78.1
Patchnames:
SUSE-SLE-SDK-12-SP1-2016-1254
SUSE Linux Enterprise Software Development Kit 12 SP2
  • MozillaFirefox-devel >= 45.4.0esr-81.1
Patchnames:
SUSE Linux Enterprise Software Development Kit 12 SP2 GA MozillaFirefox-devel
SUSE Linux Enterprise for SAP 12
  • MozillaFirefox >= 45.3.0esr-78.1
  • MozillaFirefox-translations >= 45.3.0esr-78.1
Patchnames:
SUSE-SLE-SAP-12-2016-1254
SUSE Manager 2.1
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-translations >= 45.3.0esr-50.1
Patchnames:
sleman21-MozillaFirefox-12722
SUSE Manager Proxy 2.1
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-translations >= 45.3.0esr-50.1
Patchnames:
slemap21-MozillaFirefox-12722
SUSE OpenStack Cloud 5
  • MozillaFirefox >= 45.3.0esr-50.1
  • MozillaFirefox-translations >= 45.3.0esr-50.1
Patchnames:
sleclo50sp3-MozillaFirefox-12722
openSUSE 13.1
  • MozillaFirefox >= 48.0-119.1
  • MozillaFirefox-branding-upstream >= 48.0-119.1
  • MozillaFirefox-buildsymbols >= 48.0-119.1
  • MozillaFirefox-debuginfo >= 48.0-119.1
  • MozillaFirefox-debugsource >= 48.0-119.1
  • MozillaFirefox-devel >= 48.0-119.1
  • MozillaFirefox-translations-common >= 48.0-119.1
  • MozillaFirefox-translations-other >= 48.0-119.1
  • MozillaThunderbird >= 45.3.0-70.86.1
  • MozillaThunderbird-buildsymbols >= 45.3.0-70.86.1
  • MozillaThunderbird-debuginfo >= 45.3.0-70.86.1
  • MozillaThunderbird-debugsource >= 45.3.0-70.86.1
  • MozillaThunderbird-devel >= 45.3.0-70.86.1
  • MozillaThunderbird-translations-common >= 45.3.0-70.86.1
  • MozillaThunderbird-translations-other >= 45.3.0-70.86.1
  • libfreebl3 >= 3.24-83.1
  • libfreebl3-32bit >= 3.24-83.1
  • libfreebl3-debuginfo >= 3.24-83.1
  • libfreebl3-debuginfo-32bit >= 3.24-83.1
  • libsoftokn3 >= 3.24-83.1
  • libsoftokn3-32bit >= 3.24-83.1
  • libsoftokn3-debuginfo >= 3.24-83.1
  • libsoftokn3-debuginfo-32bit >= 3.24-83.1
  • mozilla-nss >= 3.24-83.1
  • mozilla-nss-32bit >= 3.24-83.1
  • mozilla-nss-certs >= 3.24-83.1
  • mozilla-nss-certs-32bit >= 3.24-83.1
  • mozilla-nss-certs-debuginfo >= 3.24-83.1
  • mozilla-nss-certs-debuginfo-32bit >= 3.24-83.1
  • mozilla-nss-debuginfo >= 3.24-83.1
  • mozilla-nss-debuginfo-32bit >= 3.24-83.1
  • mozilla-nss-debugsource >= 3.24-83.1
  • mozilla-nss-devel >= 3.24-83.1
  • mozilla-nss-sysinit >= 3.24-83.1
  • mozilla-nss-sysinit-32bit >= 3.24-83.1
  • mozilla-nss-sysinit-debuginfo >= 3.24-83.1
  • mozilla-nss-sysinit-debuginfo-32bit >= 3.24-83.1
  • mozilla-nss-tools >= 3.24-83.1
  • mozilla-nss-tools-debuginfo >= 3.24-83.1
Patchnames:
2016-1120
2016-960
openSUSE 13.2
  • MozillaFirefox >= 48.0-74.1
  • MozillaFirefox-branding-upstream >= 48.0-74.1
  • MozillaFirefox-buildsymbols >= 48.0-74.1
  • MozillaFirefox-debuginfo >= 48.0-74.1
  • MozillaFirefox-debugsource >= 48.0-74.1
  • MozillaFirefox-devel >= 48.0-74.1
  • MozillaFirefox-translations-common >= 48.0-74.1
  • MozillaFirefox-translations-other >= 48.0-74.1
  • MozillaThunderbird >= 45.3.0-46.2
  • MozillaThunderbird-buildsymbols >= 45.3.0-46.2
  • MozillaThunderbird-debuginfo >= 45.3.0-46.2
  • MozillaThunderbird-debugsource >= 45.3.0-46.2
  • MozillaThunderbird-devel >= 45.3.0-46.2
  • MozillaThunderbird-translations-common >= 45.3.0-46.2
  • MozillaThunderbird-translations-other >= 45.3.0-46.2
  • libfreebl3 >= 3.24-37.1
  • libfreebl3-32bit >= 3.24-37.1
  • libfreebl3-debuginfo >= 3.24-37.1
  • libfreebl3-debuginfo-32bit >= 3.24-37.1
  • libsoftokn3 >= 3.24-37.1
  • libsoftokn3-32bit >= 3.24-37.1
  • libsoftokn3-debuginfo >= 3.24-37.1
  • libsoftokn3-debuginfo-32bit >= 3.24-37.1
  • mozilla-nss >= 3.24-37.1
  • mozilla-nss-32bit >= 3.24-37.1
  • mozilla-nss-certs >= 3.24-37.1
  • mozilla-nss-certs-32bit >= 3.24-37.1
  • mozilla-nss-certs-debuginfo >= 3.24-37.1
  • mozilla-nss-certs-debuginfo-32bit >= 3.24-37.1
  • mozilla-nss-debuginfo >= 3.24-37.1
  • mozilla-nss-debuginfo-32bit >= 3.24-37.1
  • mozilla-nss-debugsource >= 3.24-37.1
  • mozilla-nss-devel >= 3.24-37.1
  • mozilla-nss-sysinit >= 3.24-37.1
  • mozilla-nss-sysinit-32bit >= 3.24-37.1
  • mozilla-nss-sysinit-debuginfo >= 3.24-37.1
  • mozilla-nss-sysinit-debuginfo-32bit >= 3.24-37.1
  • mozilla-nss-tools >= 3.24-37.1
  • mozilla-nss-tools-debuginfo >= 3.24-37.1
Patchnames:
openSUSE-2016-1057
openSUSE-2016-937
openSUSE Leap 42.1
  • MozillaFirefox >= 48.0-27.1
  • MozillaFirefox-branding-upstream >= 48.0-27.1
  • MozillaFirefox-buildsymbols >= 48.0-27.1
  • MozillaFirefox-debuginfo >= 48.0-27.1
  • MozillaFirefox-debugsource >= 48.0-27.1
  • MozillaFirefox-devel >= 48.0-27.1
  • MozillaFirefox-translations-common >= 48.0-27.1
  • MozillaFirefox-translations-other >= 48.0-27.1
  • MozillaThunderbird >= 45.3.0-19.2
  • MozillaThunderbird-buildsymbols >= 45.3.0-19.2
  • MozillaThunderbird-debuginfo >= 45.3.0-19.2
  • MozillaThunderbird-debugsource >= 45.3.0-19.2
  • MozillaThunderbird-devel >= 45.3.0-19.2
  • MozillaThunderbird-translations-common >= 45.3.0-19.2
  • MozillaThunderbird-translations-other >= 45.3.0-19.2
  • libfreebl3 >= 3.24-21.1
  • libfreebl3-32bit >= 3.24-21.1
  • libfreebl3-debuginfo >= 3.24-21.1
  • libfreebl3-debuginfo-32bit >= 3.24-21.1
  • libsoftokn3 >= 3.24-21.1
  • libsoftokn3-32bit >= 3.24-21.1
  • libsoftokn3-debuginfo >= 3.24-21.1
  • libsoftokn3-debuginfo-32bit >= 3.24-21.1
  • mozilla-nss >= 3.24-21.1
  • mozilla-nss-32bit >= 3.24-21.1
  • mozilla-nss-certs >= 3.24-21.1
  • mozilla-nss-certs-32bit >= 3.24-21.1
  • mozilla-nss-certs-debuginfo >= 3.24-21.1
  • mozilla-nss-certs-debuginfo-32bit >= 3.24-21.1
  • mozilla-nss-debuginfo >= 3.24-21.1
  • mozilla-nss-debuginfo-32bit >= 3.24-21.1
  • mozilla-nss-debugsource >= 3.24-21.1
  • mozilla-nss-devel >= 3.24-21.1
  • mozilla-nss-sysinit >= 3.24-21.1
  • mozilla-nss-sysinit-32bit >= 3.24-21.1
  • mozilla-nss-sysinit-debuginfo >= 3.24-21.1
  • mozilla-nss-sysinit-debuginfo-32bit >= 3.24-21.1
  • mozilla-nss-tools >= 3.24-21.1
  • mozilla-nss-tools-debuginfo >= 3.24-21.1
Patchnames:
openSUSE-2016-1057
openSUSE-2016-937
openSUSE Leap 42.2
  • MozillaFirefox >= 49.0.2-37.1
  • MozillaFirefox-translations-common >= 49.0.2-37.1
  • MozillaThunderbird >= 45.4.0-23.1
  • MozillaThunderbird-translations-common >= 45.4.0-23.1
Patchnames:
openSUSE Leap 42.2 GA MozillaFirefox
openSUSE Leap 42.2 GA MozillaThunderbird
openSUSE Tumbleweed
  • MozillaFirefox >= 50.1.0-1.1
  • MozillaFirefox-branding-upstream >= 50.1.0-1.1
  • MozillaFirefox-buildsymbols >= 50.1.0-1.1
  • MozillaFirefox-devel >= 50.1.0-1.1
  • MozillaFirefox-translations-common >= 50.1.0-1.1
  • MozillaFirefox-translations-other >= 50.1.0-1.1
  • MozillaThunderbird >= 45.5.1-1.1
  • MozillaThunderbird-buildsymbols >= 45.5.1-1.1
  • MozillaThunderbird-devel >= 45.5.1-1.1
  • MozillaThunderbird-translations-common >= 45.5.1-1.1
  • MozillaThunderbird-translations-other >= 45.5.1-1.1
Patchnames:
openSUSE Tumbleweed GA MozillaFirefox
openSUSE Tumbleweed GA MozillaThunderbird