| Summary: | Firefox and Thunderbird 24.6 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | sysadmin-bugs, tmb, wrw105 |
| Version: | 4 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/602039/ | ||
| Whiteboard: | MGA3TOO has_procedure advisory mga4-32-ok mga4-64-ok mga3-32-ok mga3-64-ok | ||
| Source RPM: | firefox, thunderbird, rootcerts, nspr, nss | CVE: | |
| Status comment: | |||
|
Description
David Walser
2014-06-10 22:48:47 CEST
David Walser
2014-06-10 22:48:53 CEST
Whiteboard:
(none) =>
MGA3TOO No PoCs on Securityfocus. Tested mga4-32 for general use. FF: acid 3 for rendering sunspider for javascript javatester for java youtube for flash general browsing TB: send/receive/move/delete on smtp/imap All OK, no regressions noted. CC:
(none) =>
wrw105 tested mga4-64 as above, all OK. Whiteboard:
MGA3TOO mga4-32-ok =>
MGA3TOO mga4-32-ok mga4-64-ok tested mga3-32 as above, all OK. Whiteboard:
MGA3TOO mga4-32-ok mga4-64-ok =>
MGA3TOO mga4-32-ok mga4-64-ok mga3-32-ok tested mga3-64 as above, all OK. Ready for validation when advisory uploaded to SVN. Whiteboard:
MGA3TOO mga4-32-ok mga4-64-ok mga3-32-ok =>
MGA3TOO mga4-32-ok mga4-64-ok mga3-32-ok mga3-64-ok Advisory: ======================== Updated firefox and thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541 http://www.mozilla.org/security/announce/2014/mfsa2014-48.html http://www.mozilla.org/security/announce/2014/mfsa2014-49.html http://www.mozilla.org/security/announce/2014/mfsa2014-52.html http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html https://rhn.redhat.com/errata/RHSA-2014-0741.html https://rhn.redhat.com/errata/RHSA-2014-0742.html Thanks both. Validating. Advisory uploaded. Could sysadmin please push to 3 & 4 updates Thanks Keywords:
(none) =>
validated_update Update pushed: http://advisories.mageia.org/MGASA-2014-0260.html Status:
NEW =>
RESOLVED This update (specifically nspr) also fixed CVE-2014-1545: http://lwn.net/Vulnerabilities/602042/ Advisory addendum: Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1545 http://www.mozilla.org/security/announce/2014/mfsa2014-55.html URL:
(none) =>
http://lwn.net/Vulnerabilities/602039/ |