更新 gdk pixbuf 库以修复三个安全问题。

修复了这些安全问题：

- CVE-2015-7673：修复缩放 gif 时存在的更多溢出 (bsc#948791)

- CVE-2015-4491：在缩放时检查分配内存之前的溢出 (bsc#942801)

- CVE-2015-7673：修复缩放 TGA 文件时存在的溢出和 DoS (bsc#948790)。

- CVE-2015-7674：修复缩放 GIF 文件时存在的溢出 (bsc#948791)。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

此次更新到 Thunderbird 38.2.0 修复了以下问题 (bnc#940806)：

- MFSA 2015-79/CVE-2015-4473 各种内存安全危害

- MFSA 2015-80/CVE-2015-4475 (bmo#1175396) 使用畸形 MP3 文件时发生越界读取

- MFSA 2015-82/CVE-2015-4478 (bmo#1105914) 重新定义不可配置的 JavaScript 对象属性

- MFSA 2015-83/CVE-2015-4479/CVE-2015-4480/CVE-2015-4493 libstagefright 中的溢出问题

- MFSA 2015-84/CVE-2015-4481 (bmo1171518) 通过包含硬链接的 Mozilla Maintenance Service 进行的任意文件改写（仅影响 Windows）

- MFSA 2015-85/CVE-2015-4482 (bmo#1184500) 通过更新程序和恶意 MAR 文件进行的越界写入（不会影响未随附更新程序的 openSUSE RPM 程序包）

- MFSA 2015-87/CVE-2015-4484 (bmo#1171540) 在 JavaScript 中使用共享内存时发生崩溃

- MFSA 2015-88/CVE-2015-4491 (bmo#1184009) 缩放位图图像时 gdk-pixbuf 中的堆溢出

- MFSA 2015-89/CVE-2015-4485/CVE-2015-4486（bmo#1177948、bmo#1178148）解码 WebM 视频时 Libvpx 中的缓冲区溢出

- MFSA 2015-90/CVE-2015-4487/CVE-2015-4488/CVE-2015-4489 通过代码检查发现了多种漏洞

- MFSA 2015-92/CVE-2015-4492 (bmo#1185820) 包含共享线程的 XMLHttpRequest 中的释放后使用

Mozilla Firefox 正升级到目前的 Firefox 38ESR 分支（具体为 38.2.0ESR 版本）。

修复的安全问题：

- MFSA 2015-78 / CVE-2015-4495：通过 PDF 阅读器实现的同源违反和本地文件窃取

- MFSA 2015-79 / CVE-2015-4473/CVE-2015-4474：
各种内存安全危害 (rv:40.0 / rv:38.2)

- MFSA 2015-80 / CVE-2015-4475：使用畸形 MP3 文件时发生越界读取

- MFSA 2015-82 / CVE-2015-4478：重新定义不可配置的 JavaScript 对象属性

- MFSA 2015-83 / CVE-2015-4479：libstagefright 中的溢出问题

- MFSA 2015-87 / CVE-2015-4484：在 JavaScript 中使用共享内存时发生崩溃

- MFSA 2015-88 / CVE-2015-4491：缩放位图图像时 gdk-pixbuf 中的堆溢出

- MFSA 2015-89 / CVE-2015-4485/CVE-2015-4486：解码 WebM 视频时 Libvpx 中的缓冲区溢出

- MFSA 2015-90 / CVE-2015-4487/CVE-2015-4488/CVE-2015-4489：
通过代码检查发现了多种漏洞

- MFSA 2015-92 / CVE-2015-4492：包含共享线程的 XMLHttpRequest 中的释放后使用

此更新还包含从 31ESR 到 38ESR 的许多功能改进和缺陷补丁。

另外，Mozilla NSS 库将其 CKBI API 从 1.98 切换到了 2.4， Firefox 38ESR 使用 2.4 版本。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

The version of Mozilla Firefox is prior to 40.0 and is affected by multiple vulnerabilities : 

 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4473) 
 - Multiple memory corruption issues exist that allow a remote attacker, via a specially crafted web page, to corrupt memory and potentially execute arbitrary code. (CVE-2015-4474) 
 - An out-of-bounds read error exists in the 'PlayFromAudioQueue()' function due to improper handling of mismatched sample formats. A remote attacker can exploit this, via a specially crafted MP3 file, to disclose memory contents or execute arbitrary code. (CVE-2015-4475) 
 - A use-after-free error exists in the Web Audio API during MediaStream playback. A remote attacker can exploit this to dereference already freed memory, resulting in the potential execution of arbitrary code. (CVE-2015-4477) 
 - A same-origin policy bypass vulnerability exists due to non-configurable properties being redefined in violation of the ECMAScript 6 standard during JSON parsing. A remote attacker can exploit this, by editing these properties to arbitrary values, to bypass the same-origin policy. (CVE-2015-4478) 
 - Multiple integer overflow conditions exist due to improper validation of user-supplied input when handling 'saio' chunks in MPEG4 video. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4479) 
 - An integer overflow condition exists in the bundled libstagefright component when handling H.264 media content. A remote attacker can exploit this, via a specially crafted MPEG4 file, to execute arbitrary code. (CVE-2015-4480) 
 - An arbitrary file overwrite vulnerability exists in the Mozilla Maintenance Service due to a race condition. An attacker can exploit this, via the use of a hard link, to overwrite arbitrary files with log output. (CVE-2015-4481) 
 - An out-of-bounds write error exists due to an array indexing flaw in the 'mar_consume_index()' function when handling index names in MAR files. An attacker can exploit this to execute arbitrary code. (CVE-2015-4482) 
 - A security bypass vulnerability exists due to a flaw in the 'ShouldLoad()' function that occurs during the handling of POST requests to URLs using the 'feed:' URI handler. An attacker can exploit this to bypass the mixed content blocker. (CVE-2015-4483) 
 - A denial of service vulnerability exists when handling JavaScript using shared memory without properly gating access to Atomics and SharedArrayBuffer views. An attacker can exploit this to crash the program, resulting in a denial of service condition. (CVE-2015-4484) 
 - A heap-based buffer overflow condition exists in the  'resize_context_buffers()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4485) 
 - A heap-based buffer overflow condition exists in the 'decrease_ref_count()' function due to improper validation of user-supplied input. A remote attacker can exploit this, via specially crafted WebM content, to cause a heap-based buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4486) 
 - A buffer overflow condition exists in the 'ReplacePrep()' function. A remote attacker can exploit this to cause a buffer overflow, resulting in the execution of arbitrary code. (CVE-2015-4487) 
 - A use-after-free error exists in the 'operator=()' function. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4488) 
 - A memory corruption issue exists in the 'nsTArray_Impl()' function due to improper validation of user-supplied input during self-assignment. An attacker can exploit this to corrupt memory, resulting in the execution of arbitrary code. (CVE-2015-4489) 
 - A security bypass vulnerability exists due to a discrepancy in the implementation of Content Security Policy and the CSP specification. The specification states that 'blob:', 'data:', and 'filesystem:' URLs should be excluded in case of a wildcard when matching source expressions, but Mozilla's implementation allows these in the case of an asterisk wildcard. A remote attacker can exploit this to bypass restrictions. (CVE-2015-4490) 
 - A use-after-free error exists in the 'XMLHttpRequest::Open()' function due to improper handling of recursive calls. An attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-4492) 
 - An integer underflow condition exists in the bundled libstagefright library. An attacker can exploit this to crash the application, resulting in a denial of service condition. (CVE-2015-4493) 
 - A flaw in the same origin policy in which an attacker can inject script code into a non-privileged part of browser's built-in PDF reader, resulting in gaining access to sensitive local files. (CVE-2015-4495)

ID	名稱	產品	系列	已發布	已更新	嚴重性
87215	SUSE SLED12 / SLES12 安全更新：gdk-pixbuf (SUSE-SU-2015:2195-1)	Nessus	SuSE Local Security Checks	2015/12/7	2021/1/6	medium
85702	openSUSE 安全更新：MozillaThunderbird (openSUSE-2015-558)	Nessus	SuSE Local Security Checks	2015/8/31	2021/1/19	critical
85906	SUSE SLED11 / SLES11 安全更新：MozillaFirefox、mozilla-nss (SUSE-SU-2015:1528-1)	Nessus	SuSE Local Security Checks	2015/9/11	2022/5/25	critical
8856	Mozilla Firefox < 40.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2015/9/9	2019/3/6	critical

偵測

搜尋 Plugin

medium

critical

critical

critical