Bug 16698 - Iceape multiple vulnerabilities fixed in seamonkey 2.35
Summary: Iceape multiple vulnerabilities fixed in seamonkey 2.35
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: http://lwn.net/Vulnerabilities/656896/
Whiteboard: MGA4TOO advisory mga4-64-ok mga5-64-o...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-09-04 15:35 CEST by Bill Wilkinson
Modified: 2015-09-08 21:41 CEST (History)
3 users (show)

See Also:
Source RPM: iceape
CVE:
Status comment:


Attachments

Description Bill Wilkinson 2015-09-04 15:35:47 CEST
Seamonkey 2.35 has been released with multiple security fixes since the last release in March.

Reproducible: 

Steps to Reproduce:
Christiaan Welvaart 2015-09-04 16:22:19 CEST

CC: (none) => cjw
Assignee: bugsquad => cjw
Summary: Iceape multiple vulnerabilities fixed in seamonkey 2.23 => Iceape multiple vulnerabilities fixed in seamonkey 2.35

Comment 1 Christiaan Welvaart 2015-09-06 22:54:34 CEST
Updated packages are ready for testing:

MGA4
Source RPM:
iceape-2.35-1.mga4.src.rpm

Binary RPMS:
iceape-2.35-1.mga4.i586.rpm
iceape-2.35-1.mga4.x86_64

MGA5
Source RPM:
iceape-2.35-1.mga5.src.rpm

Binary RPMS:
iceape-2.35-1.mga5.i586.rpm
iceape-2.35-1.mga5.x86_64.rpm


Proposed advisory:



Updated iceape packages fix security issues:

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0814, CVE-2015-0815)

Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file. (CVE-2015-0813)

Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain. (CVE-2015-0812)

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. (CVE-2015-0816)

The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation. (CVE-2015-0811)

The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors. (CVE-2015-0808)

The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638. (CVE-2015-0807)

The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content. (CVE-2015-0805)

The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content. (CVE-2015-0806)

The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document. (CVE-2015-0803)

The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element. (CVE-2015-0804)

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818. (CVE-2015-0801)

Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods. (CVE-2015-0802)

The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header. (CVE-2015-0799)

Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization. (CVE-2015-2706)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-2708)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-2709)

Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence. (CVE-2015-2710)

Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component. (CVE-2015-2711)

The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript. (CVE-2015-2712)

Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text. (CVE-2015-2713)

Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown. (CVE-2015-2715)

Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data. (CVE-2015-2716)

Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata. (CVE-2015-2717)

The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data. (CVE-2015-2718)

Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file. (CVE-2015-4496)





References:
http://www.seamonkey-project.org/releases/seamonkey2.35/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0799
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0801
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0805
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0811
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0813
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0815
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0816
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2706
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2711
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2715
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2717
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2718
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4496
https://www.mozilla.org/en-US/security/advisories/mfsa2015-30/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-31/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-32/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-33/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-34/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-36/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-37/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-38/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-39/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-40/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-42/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-44/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-46/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-48/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-49/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-51/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-53/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-54/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-55/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-56/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-93/

Assignee: cjw => qa-bugs
Whiteboard: (none) => MGA4TOO

David Walser 2015-09-07 01:20:16 CEST

Source RPM: (none) => iceape

David Walser 2015-09-07 01:20:28 CEST

Component: RPM Packages => Security

Comment 2 Bill Wilkinson 2015-09-07 05:23:56 CEST
Tested mga4-64:

Browser:
jetstream for javascript, acid3, javatester, youtube for flash, general browsing

Mail:
send/receive/move/delete IMAP/SMTP OK.  Warning comes up for lightning integrated, but is inaccessible. Adding Lightning extension works normally.

Chatzilla
Connected to Freenode, log onto #mageia-qa. 

All OK

CC: (none) => wrw105
Whiteboard: MGA4TOO => MGA4TOO mga4-64-ok

Comment 3 Bill Wilkinson 2015-09-07 14:57:59 CEST
Tested mga5-64 as above. same results.

Whiteboard: MGA4TOO mga4-64-ok => MGA4TOO mga4-64-ok mga5-64-ok

Comment 4 Bill Wilkinson 2015-09-07 16:58:46 CEST
Tested mga5-32 as above.

jetstream seems to be a bit more demanding than sunspider was, as I get a lot of script not responding warnings.  Enough passes that the javascript seems to be working.  Otherwise, OK.

Re: built-in lightning. It appears that lightning needs to be removed from the older version and the calendar data folder in .mozilla/seamonkey/extensions needs to be renamed prior to iceape install.  Will verify that tomorrow AM (limited bandwidth). Otherwise, an updated lightning extension works well.

Whiteboard: MGA4TOO mga4-64-ok mga5-64-ok => MGA4TOO mga4-64-ok mga5-64-ok mga4-32-ok

Comment 5 Bill Wilkinson 2015-09-07 17:01:06 CEST
Correction: .mozilla/seamonkey/{blah blah blah}.default

Whiteboard: MGA4TOO mga4-64-ok mga5-64-ok mga4-32-ok => MGA4TOO mga4-64-ok mga5-64-ok mga5-32-ok

Comment 6 claire robinson 2015-09-07 17:04:05 CEST
Advisory uploaded.

Validate it when you're happy with it please Bill

Whiteboard: MGA4TOO mga4-64-ok mga5-64-ok mga5-32-ok => MGA4TOO advisory mga4-64-ok mga5-64-ok mga5-32-ok

Comment 7 Bill Wilkinson 2015-09-07 17:30:41 CEST
I'm happy with it and since this is the first update from upstream since March due to issues with the build system, We should probably push ASAP.

Once I get the built-in calendar stuff straightened out, I'll post the solution in this bug report.  I had a similar issue when Thunderbird 38 came out, so I'm probably not the only one!

mga4-32 tested as above, all ok.

Validating.

Keywords: (none) => validated_update
Whiteboard: MGA4TOO advisory mga4-64-ok mga5-64-ok mga5-32-ok => MGA4TOO advisory mga4-64-ok mga5-64-ok mga5-32-ok mga4-32-ok
CC: (none) => sysadmin-bugs

Comment 8 Christiaan Welvaart 2015-09-07 17:40:36 CEST
(In reply to Bill Wilkinson from comment #7)
> Once I get the built-in calendar stuff straightened out, I'll post the
> solution in this bug report.  I had a similar issue when Thunderbird 38 came
> out, so I'm probably not the only one!

I enabled the calendar (lightning) in iceape 2.15-0.b5.1.mga3 but when I tested it later it didn't work so I disabled it again in iceape 2.31-1.mga5. Neither 2.33.1 nor 2.35 should have a bundled lightning calendar component: the lightning extension needs to be installed for calendar features in mailnews.
Comment 9 Mageia Robot 2015-09-08 09:21:54 CEST
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0342.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 10 Bill Wilkinson 2015-09-08 15:07:29 CEST
(In reply to Christiaan Welvaart from comment #8)
> (In reply to Bill Wilkinson from comment #7)
> > Once I get the built-in calendar stuff straightened out, I'll post the
> > solution in this bug report.  I had a similar issue when Thunderbird 38 came
> > out, so I'm probably not the only one!
> 
> I enabled the calendar (lightning) in iceape 2.15-0.b5.1.mga3 but when I
> tested it later it didn't work so I disabled it again in iceape 2.31-1.mga5.
> Neither 2.33.1 nor 2.35 should have a bundled lightning calendar component:
> the lightning extension needs to be installed for calendar features in
> mailnews.

I thought I saw that it was just added in to the final release cycle this time.  It took me a while to get it working under Thunderbird, and I think it was with the procedure I mentioned above, namely: remove lightning prior to iceape install and remove/rename the calendar directory before running iceape (can be done at the same time as lightning removal).
David Walser 2015-09-08 21:41:39 CEST

URL: (none) => http://lwn.net/Vulnerabilities/656896/


Note You need to log in before you can comment on or make changes to this bug.