Bug 20025

(In reply to Bill Wilkinson from comment #0)
> The Seamonkey team has released Seamonkey 2.46 with multiple security
> updates.

From https://unofficialseamonkeynews.wordpress.com/2016/12/22/seamonkey-2-46-release-additional-release-notes I understand that the bugs (also non-security bugs) of which it is sure they are fixed, are listed here
https://bugzilla.mozilla.org/buglist.cgi?cmdtype=dorem&remaction=run&namedcmd=BugsReallyFixedforSM46-2&sharer_id=41036

(Why do we call it iceape if we don't have the seamonkey derivative, but seamonkey itself)?

Anyway, assigning to maintainer.

Assignee: bugsquad => cjw
CC: (none) => marja11
Version: 5 => Cauldron
Whiteboard: (none) => MGA5TOO
Source RPM: (none) => iceape-2.40-3.mga6, iceape-2.40-1.mga5
QA Contact: (none) => security

Packages are available for testing.

MGA5
SRPM:
iceape-2.46-1.mga5.src.rpm
RPMS:
iceape-2.46-1.mga5.i586.rpm
iceape-2.46-1.mga5.x86_64.rpm



Proposed advisory:



Updated Iceape packages derived from Seamonkey include security fixes from Mozilla Firefox:

Heap-based buffer overflow in the nsCaseTransformTextRunFactory::TransformString function in Seamonkey before 2.46 allows remote attackers to cause a denial of service (boolean out-of-bounds write) or possibly have unspecified other impact via Unicode characters that are mishandled during text conversion. (CVE-2016-5270)

The PropertyProvider::GetSpacingInternal function in Seamonkey before 2.46 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via text runs in conjunction with a "display: contents" Cascading Style Sheets (CSS) property. (CVE-2016-5271)

The nsImageGeometryMixin class in Seamonkey before 2.46 does not properly perform a cast of an unspecified variable during handling of INPUT elements, which allows remote attackers to execute arbitrary code via a crafted web site. (CVE-2016-5272)

Use-after-free vulnerability in the mozilla::a11y::DocAccessible::ProcessInvalidationList function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an aria-owns attribute. (CVE-2016-5276)

Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation. (CVE-2016-5274)

Use-after-free vulnerability in the nsRefreshDriver::Tick function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging improper interaction between timeline destruction and the Web Animations model implementation. (CVE-2016-5277)

Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image. (CVE-2016-5278)

Use-after-free vulnerability in the mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap function in Seamonkey before 2.46 allows remote attackers to execute arbitrary code via bidirectional text. (CVE-2016-5280)

Use-after-free vulnerability in the DOMSVGLength class in Seamonkey before 2.46 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document. (CVE-2016-5281)

Seamonkey before 2.46 relies on unintended expiration dates for Preloaded Public Key Pinning, which allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority. (CVE-2016-5284)

Multiple unspecified vulnerabilities in the browser engine in Seamonkey before 2.46 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2016-5257)


References:
https://www.mozilla.org/en-US/security/advisories/mfsa2016-85/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2827
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5257
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5270
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5271
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5272
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5274
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5276
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5277
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5278
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5280
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5281
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5284

CC: (none) => cjw
Version: Cauldron => 5
Assignee: cjw => qa-bugs

Tested Mga5-64

Browser: 
General browsing, Jetstream for javascript, acid3, flash game for flash plugin, Javatester for icedteaweb integration 

Mail:
SMTP/IMAP send/receive/move/delete OK

Chatzilla: connected to freenode with SASL script. OK

Whiteboard: MGA5TOO => MGA5TOO mga5-64-ok
CC: (none) => wrw105

Similar testing under Mageia 5 i586 in a vb guest.

Validating the update

Whiteboard: MGA5TOO mga5-64-ok advisory => MGA5TOO mga5-64-ok advisory mga5-32-ok
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Update ID assignment failed

Checking for QA validation keyword⦠  â
Checking dependent bugs⦠             â (None found)
Checking SRPMs⦠                      â (5/core/iceape-1.0-1.mga5) 


'validated_update' keyword reset.

Keywords: validated_update => (none)

SRPM fixed.

Keywords: (none) => validated_update

An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0059.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED