Bug 977373 - (CVE-2016-2804) VUL-0: CVE-2016-2804: MozillaFirefox: Memory safety bugs fixed in Firefox 46 (MFSA 2016-39)
(CVE-2016-2804)
VUL-0: CVE-2016-2804: MozillaFirefox: Memory safety bugs fixed in Firefox 46 ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
All openSUSE 42.1
: P3 - Medium : Major
: ---
Assigned To: Security Team bot
Security Team bot
:
Depends on: 977333
Blocks:
  Show dependency treegraph
 
Reported: 2016-04-27 08:34 UTC by Andreas Stieger
Modified: 2020-04-05 18:20 UTC (History)
6 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2016-04-27 08:34:19 UTC
https://www.mozilla.org/en-US/security/advisories/mfsa2016-39/

Mozilla developers fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. 

Gary Kwong, Christian Holler, Andrew McCreight, Boris Zbarsky, and Steve Fink reported memory safety problems and crashes that are fixed in Firefox 46.

Memory safety bugs fixed in Firefox 46 (CVE-2016-2804)
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1240880,1141382,1229855,1155328,1255298,1249183

This one affects openSUSE only.
Comment 1 Swamp Workflow Management 2016-04-27 22:00:16 UTC
bugbot adjusting priority
Comment 2 Andreas Stieger 2016-04-28 12:19:46 UTC
Adjust severity for memory safety bugs
Comment 3 Bernhard Wiedemann 2016-04-30 08:00:16 UTC
This is an autogenerated message for OBS integration:
This bug (977373) was mentioned in
https://build.opensuse.org/request/show/392977 Factory / MozillaFirefox
https://build.opensuse.org/request/show/392978 42.1 / MozillaFirefox
https://build.opensuse.org/request/show/392979 13.2 / MozillaFirefox
https://build.opensuse.org/request/show/392980 13.1 / MozillaFirefox
Comment 4 Andreas Stieger 2016-04-30 10:21:28 UTC
openSUSE submitted, updates running
Comment 5 Bernhard Wiedemann 2016-05-04 06:00:17 UTC
This is an autogenerated message for OBS integration:
This bug (977373) was mentioned in
https://build.opensuse.org/request/show/393514 Factory / MozillaFirefox
Comment 6 Swamp Workflow Management 2016-05-04 13:08:52 UTC
openSUSE-SU-2016:1211-1: An update that fixes 10 vulnerabilities is now available.

Category: security (important)
Bug References: 977333,977373,977375,977376,977379,977381,977382,977384,977386,977388
CVE References: CVE-2016-2804,CVE-2016-2806,CVE-2016-2807,CVE-2016-2808,CVE-2016-2811,CVE-2016-2812,CVE-2016-2814,CVE-2016-2816,CVE-2016-2817,CVE-2016-2820
Sources used:
openSUSE Leap 42.1 (src):    MozillaFirefox-46.0-21.1, mozilla-nss-3.22.3-15.2
openSUSE 13.2 (src):    MozillaFirefox-46.0-68.1, mozilla-nss-3.22.3-31.1
Comment 7 Andreas Stieger 2016-05-04 13:20:26 UTC
Closing bugs exclusive to openSUSE as fixed.
Comment 8 Swamp Workflow Management 2016-05-06 14:08:01 UTC
openSUSE-SU-2016:1251-1: An update that fixes 13 vulnerabilities is now available.

Category: security (moderate)
Bug References: 977333,977373,977375,977376,977377,977378,977379,977380,977381,977382,977384,977386,977388
CVE References: CVE-2016-2804,CVE-2016-2806,CVE-2016-2807,CVE-2016-2808,CVE-2016-2809,CVE-2016-2810,CVE-2016-2811,CVE-2016-2812,CVE-2016-2813,CVE-2016-2814,CVE-2016-2816,CVE-2016-2817,CVE-2016-2820
Sources used:
openSUSE 13.1 (src):    MozillaFirefox-46.0-113.2, mozilla-nss-3.22.3-77.1