| Summary: | Firefox 38.5 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | sysadmin-bugs, tarazed25, westel |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/668127/ | ||
| Whiteboard: | advisory MGA5-32-OK MGA5-64-OK | ||
| Source RPM: | nspr, nss, firefox, firefox-l10n | CVE: | |
| Status comment: | |||
|
Description
David Walser
2015-12-15 19:06:35 CET
Working fine on Mageia 5 i586. Will post advisory when it's available. Whiteboard:
(none) =>
MGA5-32-OK Upstream references: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7210 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7212 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7213 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7222 https://www.mozilla.org/en-US/security/advisories/mfsa2015-134/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-138/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-139/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-145/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-146/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-147/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-149/ mga5 x86_64 Mate Upgraded from Firefox 38.4. Installed the firefox-uk, en-GB versions and dependencies. All working fine, general browsing, Youtube, search and access to local ports like 631. CC:
(none) =>
tarazed25
Len Lawrence
2015-12-16 01:47:23 CET
Whiteboard:
MGA5-32-OK =>
MGA5-32-OK MGA5-64-OK mga5 i586 KDE, upgrade from firefox-0:38.4.0-1 installed: firefox 38.5.0 1.mga5 i586 firefox-en_GB 38.5.0 1.mga5 noarch libnspr4 4.11 1.mga5 i586 libnss3 3.21.0 1.mga5 i586 youtube playback -ok *flash-player-plugin not installed* browsing -ok installed flash-player-plugin browsed sites that require flash -ok un-installed flash-player-plugin CC:
(none) =>
westel Ubuntu has issued an advisory for this on December 15: http://www.ubuntu.com/usn/usn-2833-1/ Going with their CVE descriptions for now. If we don't get this pushed by time RedHat posts their advisory, I'll update this at that time. Advisory: ======================== Updated firefox packages fix security vulnerabilities: Multiple memory safety issues in Firefox were discovered. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-7201). Ronald Crane discovered a buffer overflow through code inspection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-7205). Looben Yang discovered a use-after-free in WebRTC when closing channels in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-7210). Abhishek Arya discovered an integer overflow when allocating large textures. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-7212). Ronald Crane dicovered an integer overflow when processing MP4 format video in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-7213). Tsubasa Iinuma discovered a way to bypass same-origin restrictions using data: and view-source: URLs. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information and read local files (CVE-2015-7214). Gerald Squelart discovered an integer underflow in the libstagefright library when parsing MP4 format video in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox (CVE-2015-7222). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7210 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7212 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7213 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7222 https://www.mozilla.org/en-US/security/advisories/mfsa2015-134/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-138/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-139/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-145/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-146/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-147/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-149/ https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ http://www.ubuntu.com/usn/usn-2833-1/ Validating. Advisory uploaded. Please push to 5 updates Thanks Keywords:
(none) =>
validated_update The more concise RedHat advisory, if someone wouldn't mind changing it in SVN. Advisory: ======================== Updated firefox packages fix security vulnerabilities: Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2015-7201, CVE-2015-7205, CVE-2015-7210, CVE-2015-7212, CVE-2015-7213, CVE-2015-7222). A flaw was found in the way Firefox handled content using the 'data:' and 'view-source:' URIs. An attacker could use this flaw to bypass the same-origin policy and read data from cross-site URLs and local files (CVE-2015-7214). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7205 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7210 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7212 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7213 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7222 https://www.mozilla.org/en-US/security/advisories/mfsa2015-134/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-138/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-139/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-145/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-146/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-147/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-149/ https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ https://rhn.redhat.com/errata/RHSA-2015-2657.html
David Walser
2015-12-16 19:31:01 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/668127/ An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0477.html Status:
NEW =>
RESOLVED The nss 3.21 update apparently fixed CVE-2016-1938: http://www.ubuntu.com/usn/usn-2903-1/ http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1938.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1938 http://lwn.net/Vulnerabilities/673782/ (In reply to David Walser from comment #9) > The nss 3.21 update apparently fixed CVE-2016-1938: > http://www.ubuntu.com/usn/usn-2903-1/ > http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1938.html > http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1938 > http://lwn.net/Vulnerabilities/673782/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/ It also fixed CVE-2016-1978: https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/ (In reply to David Walser from comment #10) > It also fixed CVE-2016-1978: > https://www.mozilla.org/en-US/security/advisories/mfsa2016-15/ LWN reference: http://lwn.net/Vulnerabilities/680044/ |