USN-2424-1: Firefox vulnerabilities
2 December 2014
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Releases
Packages
- firefox - Mozilla Open Source web browser
Details
Gary Kwong, Randell Jesup, Nils Ohlmeier, Jesse Ruderman, Max Jonas
Werner, Christian Holler, Jon Coppeard, Eric Rahm, Byron Campen, Eric
Rescorla, and Xidorn Quan discovered multiple memory safety issues in
Firefox. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit these to cause a denial of service
via application crash, or execute arbitrary code with the privileges of
the user invoking Firefox. (CVE-2014-1587, CVE-2014-1588)
Cody Crews discovered a way to trigger chrome-level XBL bindings from web
content in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
bypass security restrictions. (CVE-2014-1589)
Joe Vennix discovered a crash when using XMLHttpRequest in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service. (CVE-2014-1590)
Muneaki Nishimura discovered that CSP violation reports did not remove
path information in some circumstances. If a user were tricked in to
opening a specially crafted website, an attacker could potentially
exploit this to obtain sensitive information. (CVE-2014-1591)
Berend-Jan Wever discovered a use-after-free during HTML parsing. If a
user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to cause a denial of service via
application crash or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2014-1592)
Abhishek Arya discovered a buffer overflow when parsing media content. If
a user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to cause a denial of service via
application crash or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2014-1593)
Byoungyoung Lee, Chengyu Song, and Taesoo Kim discovered a bad cast in the
compositor. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause undefined
behaviour, a denial of service via application crash or execute abitrary
code with the privileges of the user invoking Firefox. (CVE-2014-1594)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 14.10
Ubuntu 14.04
Ubuntu 12.04
After a standard system update you need to restart Firefox to make
all the necessary changes.
Related notices
- USN-2428-1: thunderbird-locale-nn, thunderbird-locale-pt-pt, thunderbird-locale-ar, thunderbird-locale-fi, thunderbird-locale-sr, thunderbird-locale-nl, thunderbird-locale-es-es, thunderbird-locale-is, thunderbird-locale-ja, thunderbird-locale-es-ar, thunderbird-locale-sl, thunderbird-gnome-support, thunderbird-locale-ga, xul-ext-calendar-timezones, xul-ext-lightning, thunderbird-locale-ast, thunderbird-locale-eu, thunderbird-locale-hr, thunderbird-locale-it, thunderbird-locale-fy, thunderbird-locale-ca, thunderbird-locale-id, thunderbird-locale-nb-no, thunderbird-locale-pa, thunderbird-locale-zh-hant, thunderbird-locale-ro, thunderbird-locale-hu, thunderbird-locale-et, thunderbird-locale-he, thunderbird-locale-ga-ie, thunderbird-locale-ta, thunderbird-locale-el, thunderbird-locale-cs, thunderbird-locale-fr, thunderbird-locale-sv, thunderbird-mozsymbols, thunderbird-locale-fy-nl, thunderbird-locale-vi, thunderbird-locale-si, thunderbird-locale-bn, thunderbird-locale-sq, thunderbird-locale-zh-hans, thunderbird-locale-ta-lk, thunderbird-locale-br, thunderbird-locale-ru, thunderbird-locale-en-us, thunderbird-locale-lt, thunderbird-locale-zh-tw, thunderbird-locale-tr, thunderbird-locale-ko, thunderbird-locale-mk, thunderbird-locale-af, thunderbird, thunderbird-locale-bg, thunderbird-locale-be, thunderbird-locale-sk, thunderbird-dev, thunderbird-locale-pa-in, thunderbird-locale-en, thunderbird-locale-de, thunderbird-locale-nb, thunderbird-locale-bn-bd, thunderbird-locale-sv-se, thunderbird-locale-hy, thunderbird-locale-es, thunderbird-locale-da, thunderbird-locale-pt, thunderbird-locale-nn-no, thunderbird-locale-zh-cn, thunderbird-locale-en-gb, thunderbird-locale-gl, thunderbird-locale-ka, thunderbird-globalmenu, thunderbird-testsuite, thunderbird-locale-uk, thunderbird-locale-gd, thunderbird-locale-pl, thunderbird-locale-pt-br, xul-ext-gdata-provider, thunderbird-locale-rm