Mozilla has released Seamonkey 2.30 with additional security updates Reproducible: Steps to Reproduce:
Assignee: bugsquad => cjwCC: (none) => mageia
Updated packages are ready for testing: MGA3 Source RPM: iceape-2.30-1.mga3.src.rpm Binary RPMS: iceape-2.30-1.mga3.i586.rpm iceape-2.30-1.mga3.x86_64.rpm MGA4 Source RPM: iceape-2.30-1.mga4.src.rpm Binary RPMS: iceape-2.30-1.mga4.i586.rpm iceape-2.30-1.mga4.x86_64.rpm Proposed advisory: Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1533) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1534) The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors. (CVE-2014-1536) Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2014-1537) Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2014-1538) Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content. (CVE-2014-1540) Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content. (CVE-2014-1541) Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate. (CVE-2014-1542) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1547) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1548) The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content that is improperly handled during playback buffering. (CVE-2014-1549) Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering. (CVE-2014-1550) Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization. (CVE-2014-1561) Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event. (CVE-2014-1555) Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library. (CVE-2014-1556) The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image. (CVE-2014-1557) Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559. (CVE-2014-1558) Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1558. (CVE-2014-1559) Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use ASCII character encoding in a required context. (CVE-2014-1560) Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect. (CVE-2014-1552) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1553) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1554) Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1562) Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection. (CVE-2014-1563) Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image. (CVE-2014-1564) Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. (CVE-2014-1567) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1574) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors. () Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style. (CVE-2014-1576) The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value. (CVE-2014-1577) The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback. (CVE-2014-1578) Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element. (CVE-2014-1580) Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. (CVE-2014-1581) The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority. (CVE-2014-1582) The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user. (CVE-2014-1584) The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming. (CVE-2014-1585) content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away. (CVE-2014-1586) The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm. (CVE-2014-1583) References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1534 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1536 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1537 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1540 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1542 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1547 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1548 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1549 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1550 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1552 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1553 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1554 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1555 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1556 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1557 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1558 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1559 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1560 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1561 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1563 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1564 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1565 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1574 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1575 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1576 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1577 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1578 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1580 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1582 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1583 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1585 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1586 https://www.mozilla.org/security/announce/2014/mfsa2014-48.html https://www.mozilla.org/security/announce/2014/mfsa2014-49.html https://www.mozilla.org/security/announce/2014/mfsa2014-51.html https://www.mozilla.org/security/announce/2014/mfsa2014-52.html https://www.mozilla.org/security/announce/2014/mfsa2014-53.html https://www.mozilla.org/security/announce/2014/mfsa2014-56.html https://www.mozilla.org/security/announce/2014/mfsa2014-57.html https://www.mozilla.org/security/announce/2014/mfsa2014-58.html https://www.mozilla.org/security/announce/2014/mfsa2014-60.html https://www.mozilla.org/security/announce/2014/mfsa2014-61.html https://www.mozilla.org/security/announce/2014/mfsa2014-62.html https://www.mozilla.org/security/announce/2014/mfsa2014-64.html https://www.mozilla.org/security/announce/2014/mfsa2014-65.html https://www.mozilla.org/security/announce/2014/mfsa2014-66.html https://www.mozilla.org/security/announce/2014/mfsa2014-67.html https://www.mozilla.org/security/announce/2014/mfsa2014-68.html https://www.mozilla.org/security/announce/2014/mfsa2014-69.html https://www.mozilla.org/security/announce/2014/mfsa2014-70.html https://www.mozilla.org/security/announce/2014/mfsa2014-72.html https://www.mozilla.org/security/announce/2014/mfsa2014-74.html https://www.mozilla.org/security/announce/2014/mfsa2014-75.html https://www.mozilla.org/security/announce/2014/mfsa2014-76.html https://www.mozilla.org/security/announce/2014/mfsa2014-77.html https://www.mozilla.org/security/announce/2014/mfsa2014-78.html https://www.mozilla.org/security/announce/2014/mfsa2014-79.html https://www.mozilla.org/security/announce/2014/mfsa2014-80.html https://www.mozilla.org/security/announce/2014/mfsa2014-81.html https://www.mozilla.org/security/announce/2014/mfsa2014-82.html
Assignee: cjw => qa-bugsWhiteboard: (none) => MGA3TOO
Tested mga4-64 with the usual battery: Browser: general browsing Sunspider javascript test javatester version for java plugin acid3 youtube for flash plugin Mail: Send/receive/move/delete on IMAP/SMTP *Note: nice that it pulled the lightning update on startup! Chatzilla: Connect to freenode, join #mageia-qa All OK.
Whiteboard: MGA3TOO => MGA3TOO mga4-64-okCC: (none) => wrw105
Tested mga3-64 as above, all OK.
Whiteboard: MGA3TOO mga4-64-ok => MGA3TOO mga4-64-ok mga3-64-ok
CC: (none) => cjw
mga4-32 tested as above, all OK.
Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok => MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok
Mga3-32 tested as above, all OK. Validating. Ready for push to core/updates-testing when advisory is uploaded to svn.
Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok => MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok mga3-32-okKeywords: (none) => validated_updateCC: (none) => sysadmin-bugs
Err, ummm...make that core/updates. D'oh!
Advisory uploaded (phew!).
CC: (none) => remiWhiteboard: MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok mga3-32-ok => MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok mga3-32-ok advisory
Source RPM: (none) => iceape
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0419.html
Status: NEW => RESOLVEDResolution: (none) => FIXED