Bug 14318 - Iceape:Security updates in Seamonkey 2.30
Summary: Iceape:Security updates in Seamonkey 2.30
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok mga4-32...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-10-18 05:10 CEST by Bill Wilkinson
Modified: 2014-10-23 15:28 CEST (History)
5 users (show)

See Also:
Source RPM: iceape
CVE:
Status comment:


Attachments

Description Bill Wilkinson 2014-10-18 05:10:41 CEST
Mozilla has released Seamonkey 2.30 with additional security updates

Reproducible: 

Steps to Reproduce:
Sander Lepik 2014-10-18 12:22:38 CEST

Assignee: bugsquad => cjw
CC: (none) => mageia

Comment 1 Christiaan Welvaart 2014-10-20 22:34:21 CEST
Updated packages are ready for testing:

MGA3
Source RPM:
iceape-2.30-1.mga3.src.rpm

Binary RPMS:
iceape-2.30-1.mga3.i586.rpm
iceape-2.30-1.mga3.x86_64.rpm


MGA4
Source RPM:
iceape-2.30-1.mga4.src.rpm

Binary RPMS:
iceape-2.30-1.mga4.i586.rpm
iceape-2.30-1.mga4.x86_64.rpm



Proposed advisory:



Updated iceape packages fix security issues:

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1533)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1534)

The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors. (CVE-2014-1536)

Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2014-1537)

Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2014-1538)

Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content. (CVE-2014-1540)

Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content. (CVE-2014-1541)

Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate. (CVE-2014-1542)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1547)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1548)

The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content that is improperly handled during playback buffering. (CVE-2014-1549)

Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering. (CVE-2014-1550)

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization. (CVE-2014-1561)

Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event. (CVE-2014-1555)

Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library. (CVE-2014-1556)

The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image. (CVE-2014-1557)

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1559. (CVE-2014-1558)

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use UTF-8 character encoding in a required context, a different vulnerability than CVE-2014-1558. (CVE-2014-1559)

Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (X.509 certificate parsing outage) via a crafted certificate that does not use ASCII character encoding in a required context. (CVE-2014-1560)

Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not properly implement the sandbox attribute of the IFRAME element, which allows remote attackers to bypass intended restrictions on same-origin content via a crafted web site in conjunction with a redirect. (CVE-2014-1552)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1553)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1554)

Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1562)

Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection. (CVE-2014-1563)

Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image. (CVE-2014-1564)

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. (CVE-2014-1567)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1574)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to improper interaction between threading and garbage collection in the GCRuntime::triggerGC function in js/src/jsgc.cpp, and unknown other vectors. ()

Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style. (CVE-2014-1576)

The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value. (CVE-2014-1577)

The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback. (CVE-2014-1578)

Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element. (CVE-2014-1580)

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout. (CVE-2014-1581)

The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority. (CVE-2014-1582)

The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user. (CVE-2014-1584)

The WebRTC video-sharing feature in dom/media/MediaManager.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing actions for videos in IFRAME elements, which allows remote attackers to obtain sensitive information from the local camera by maintaining a session after the user tries to discontinue streaming. (CVE-2014-1585)

content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away. (CVE-2014-1586)

The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm. (CVE-2014-1583)



References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1533
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1534
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1536
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1537
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1538
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1540
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1541
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1542
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1547
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1548
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1549
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1550
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1552
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1553
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1554
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1556
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1557
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1558
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1559
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1560
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1561
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1562
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1563
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1564
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1565
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1567
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1574
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1575
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1576
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1577
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1578
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1580
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1582
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1583
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1584
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1585
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1586
https://www.mozilla.org/security/announce/2014/mfsa2014-48.html
https://www.mozilla.org/security/announce/2014/mfsa2014-49.html
https://www.mozilla.org/security/announce/2014/mfsa2014-51.html
https://www.mozilla.org/security/announce/2014/mfsa2014-52.html
https://www.mozilla.org/security/announce/2014/mfsa2014-53.html
https://www.mozilla.org/security/announce/2014/mfsa2014-56.html
https://www.mozilla.org/security/announce/2014/mfsa2014-57.html
https://www.mozilla.org/security/announce/2014/mfsa2014-58.html
https://www.mozilla.org/security/announce/2014/mfsa2014-60.html
https://www.mozilla.org/security/announce/2014/mfsa2014-61.html
https://www.mozilla.org/security/announce/2014/mfsa2014-62.html
https://www.mozilla.org/security/announce/2014/mfsa2014-64.html
https://www.mozilla.org/security/announce/2014/mfsa2014-65.html
https://www.mozilla.org/security/announce/2014/mfsa2014-66.html
https://www.mozilla.org/security/announce/2014/mfsa2014-67.html
https://www.mozilla.org/security/announce/2014/mfsa2014-68.html
https://www.mozilla.org/security/announce/2014/mfsa2014-69.html
https://www.mozilla.org/security/announce/2014/mfsa2014-70.html
https://www.mozilla.org/security/announce/2014/mfsa2014-72.html
https://www.mozilla.org/security/announce/2014/mfsa2014-74.html
https://www.mozilla.org/security/announce/2014/mfsa2014-75.html
https://www.mozilla.org/security/announce/2014/mfsa2014-76.html
https://www.mozilla.org/security/announce/2014/mfsa2014-77.html
https://www.mozilla.org/security/announce/2014/mfsa2014-78.html
https://www.mozilla.org/security/announce/2014/mfsa2014-79.html
https://www.mozilla.org/security/announce/2014/mfsa2014-80.html
https://www.mozilla.org/security/announce/2014/mfsa2014-81.html
https://www.mozilla.org/security/announce/2014/mfsa2014-82.html

Assignee: cjw => qa-bugs
Whiteboard: (none) => MGA3TOO

Comment 2 Bill Wilkinson 2014-10-21 04:22:31 CEST
Tested mga4-64 with the usual battery:

Browser:
general browsing
Sunspider javascript test
javatester version for java plugin
acid3
youtube for flash plugin

Mail:
Send/receive/move/delete on IMAP/SMTP
*Note: nice that it pulled the lightning update on startup!

Chatzilla:
Connect to freenode, join #mageia-qa

All OK.

Whiteboard: MGA3TOO => MGA3TOO mga4-64-ok
CC: (none) => wrw105

Comment 3 Bill Wilkinson 2014-10-21 05:22:53 CEST
Tested mga3-64 as above, all OK.

Whiteboard: MGA3TOO mga4-64-ok => MGA3TOO mga4-64-ok mga3-64-ok

Christiaan Welvaart 2014-10-21 10:36:42 CEST

CC: (none) => cjw

Comment 4 Bill Wilkinson 2014-10-21 15:20:47 CEST
mga4-32 tested as above, all OK.
Bill Wilkinson 2014-10-21 15:21:16 CEST

Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok => MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok

Comment 5 Bill Wilkinson 2014-10-21 16:11:44 CEST
Mga3-32 tested as above, all OK.

Validating.  Ready for push to core/updates-testing when advisory is uploaded to svn.

Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok => MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok mga3-32-ok
Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 6 Bill Wilkinson 2014-10-21 16:12:19 CEST
Err, ummm...make that core/updates. D'oh!
Comment 7 Rémi Verschelde 2014-10-21 16:45:21 CEST
Advisory uploaded (phew!).

CC: (none) => remi
Whiteboard: MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok mga3-32-ok => MGA3TOO mga4-64-ok mga3-64-ok mga4-32-ok mga3-32-ok advisory

Rémi Verschelde 2014-10-21 16:46:44 CEST

Source RPM: (none) => iceape

Comment 8 Mageia Robot 2014-10-23 15:28:41 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0419.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.