User: Password:
|
|
Subscribe / Log in / New account

Ubuntu alert USN-2009-1 (firefox)

From:  Chris Coulson <chris.coulson@canonical.com>
To:  ubuntu-security-announce@lists.ubuntu.com
Subject:  [USN-2009-1] Firefox vulnerabilities
Date:  Tue, 29 Oct 2013 19:21:21 +0000
Message-ID:  <52700AB1.5080206@canonical.com>
Archive-link:  Article, Thread

========================================================================== Ubuntu Security Notice USN-2009-1 October 29, 2013 firefox vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.10 - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. Software Description: - firefox: Mozilla Open Source web browser Details: Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1739, CVE-2013-5590, CVE-2013-5591, CVE-2013-5592) Jordi Chancel discovered that HTML select elements could display arbitrary content. An attacker could potentially exploit this to conduct URL spoofing or clickjacking attacks (CVE-2013-5593) Abhishek Arya discovered a crash when processing XSLT data in some circumstances. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5604) Dan Gohman discovered a flaw in the Javascript engine. When combined with other vulnerabilities, an attacked could possibly exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5595) Ezra Pool discovered a crash on extremely large pages. An attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5596) Byoungyoung Lee discovered a use-after-free when updating the offline cache. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5597) Cody Crews discovered a way to append an iframe in to an embedded PDF object displayed with PDF.js. An attacked could potentially exploit this to read local files, leading to information disclosure. (CVE-2013-5598) Multiple use-after-free flaws were discovered in Firefox. An attacker could potentially exploit these to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5599, CVE-2013-5600, CVE-2013-5601) A memory corruption flaw was discovered in the Javascript engine when using workers with direct proxies. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5602) Abhishek Arya discovered a use-after-free when interacting with HTML document templates. An attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-5603) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.10: firefox 25.0+build3-0ubuntu0.13.10.1 Ubuntu 13.04: firefox 25.0+build3-0ubuntu0.13.04.1 Ubuntu 12.10: firefox 25.0+build3-0ubuntu0.12.10.1 Ubuntu 12.04 LTS: firefox 25.0+build3-0ubuntu0.12.04.1 After a standard system update you need to restart Firefox to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2009-1 CVE-2013-1739, CVE-2013-5590, CVE-2013-5591, CVE-2013-5592, CVE-2013-5593, CVE-2013-5595, CVE-2013-5596, CVE-2013-5597, CVE-2013-5598, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602, CVE-2013-5603, CVE-2013-5604, https://launchpad.net/bugs/1245414 Package Information: https://launchpad.net/ubuntu/+source/firefox/25.0+build3-... https://launchpad.net/ubuntu/+source/firefox/25.0+build3-... https://launchpad.net/ubuntu/+source/firefox/25.0+build3-... https://launchpad.net/ubuntu/+source/firefox/25.0+build3-... -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds