Seamonkey 2.35 has been released with multiple security fixes since the last release in March. Reproducible: Steps to Reproduce:
CC: (none) => cjwAssignee: bugsquad => cjwSummary: Iceape multiple vulnerabilities fixed in seamonkey 2.23 => Iceape multiple vulnerabilities fixed in seamonkey 2.35
Updated packages are ready for testing: MGA4 Source RPM: iceape-2.35-1.mga4.src.rpm Binary RPMS: iceape-2.35-1.mga4.i586.rpm iceape-2.35-1.mga4.x86_64 MGA5 Source RPM: iceape-2.35-1.mga5.src.rpm Binary RPMS: iceape-2.35-1.mga5.i586.rpm iceape-2.35-1.mga5.x86_64.rpm Proposed advisory: Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0814, CVE-2015-0815) Use-after-free vulnerability in the AppendElements function in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux, when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted MP3 file. (CVE-2015-0813) Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain. (CVE-2015-0812) Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy, as demonstrated by the resource: URL associated with PDF.js. (CVE-2015-0816) The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation. (CVE-2015-0811) The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of memory for simple-type arrays, which might allow remote attackers to cause a denial of service (memory corruption) via unspecified vectors. (CVE-2015-0808) The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status codes for redirects after a preflight request has occurred, which allows remote attackers to bypass intended CORS access-control checks and conduct cross-site request forgery (CSRF) attacks via a crafted web site, a similar issue to CVE-2014-8638. (CVE-2015-0807) The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content. (CVE-2015-0805) The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 attempts to use memset for a memory region of negative length during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors that trigger rendering of 2D graphics content. (CVE-2015-0806) The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document. (CVE-2015-0803) The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does not properly constrain a data type after omitting namespace validation during certain tree-binding operations, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document containing a SOURCE element. (CVE-2015-0804) Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818. (CVE-2015-0801) Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods. (CVE-2015-0802) The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header. (CVE-2015-0799) Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization. (CVE-2015-2706) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-2708) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 38.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-2709) Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code via crafted SVG graphics data in conjunction with a crafted Cascading Style Sheets (CSS) token sequence. (CVE-2015-2710) Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a referrer META element in cases of context-menu navigation and middle-click navigation, which allows remote attackers to obtain sensitive information by reading web-server Referer logs that contain private data in a URL, as demonstrated by a private path component. (CVE-2015-2711) The asm.js implementation in Mozilla Firefox before 38.0 does not properly determine heap lengths during identification of cases in which bounds checking may be safely skipped, which allows remote attackers to trigger out-of-bounds write operations and possibly execute arbitrary code, or trigger out-of-bounds read operations and possibly obtain sensitive information from process memory, via crafted JavaScript. (CVE-2015-2712) Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a document containing crafted text in conjunction with a Cascading Style Sheets (CSS) token sequence containing properties related to vertical text. (CVE-2015-2713) Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) by leveraging improper Media Decoder Thread creation at the time of a shutdown. (CVE-2015-2715) Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data. (CVE-2015-2716) Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and out-of-bounds read) via an MP4 video file containing invalid metadata. (CVE-2015-2717) The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers to bypass the Same Origin Policy and obtain sensitive webchannel-response data via a crafted web site containing an IFRAME element referencing a different web site that is intended to read this data. (CVE-2015-2718) Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file. (CVE-2015-4496) References: http://www.seamonkey-project.org/releases/seamonkey2.35/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0799 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0801 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0802 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0803 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0804 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0805 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0806 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0808 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0811 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0812 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0813 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0814 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0815 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0816 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2706 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2708 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2709 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2710 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2711 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2712 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2713 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2715 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2716 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2717 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2718 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4496 https://www.mozilla.org/en-US/security/advisories/mfsa2015-30/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-31/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-32/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-33/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-34/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-36/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-37/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-38/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-39/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-40/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-42/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-44/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-45/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-46/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-48/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-49/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-51/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-53/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-54/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-55/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-56/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-93/
Assignee: cjw => qa-bugsWhiteboard: (none) => MGA4TOO
Source RPM: (none) => iceape
Component: RPM Packages => Security
Tested mga4-64: Browser: jetstream for javascript, acid3, javatester, youtube for flash, general browsing Mail: send/receive/move/delete IMAP/SMTP OK. Warning comes up for lightning integrated, but is inaccessible. Adding Lightning extension works normally. Chatzilla Connected to Freenode, log onto #mageia-qa. All OK
CC: (none) => wrw105Whiteboard: MGA4TOO => MGA4TOO mga4-64-ok
Tested mga5-64 as above. same results.
Whiteboard: MGA4TOO mga4-64-ok => MGA4TOO mga4-64-ok mga5-64-ok
Tested mga5-32 as above. jetstream seems to be a bit more demanding than sunspider was, as I get a lot of script not responding warnings. Enough passes that the javascript seems to be working. Otherwise, OK. Re: built-in lightning. It appears that lightning needs to be removed from the older version and the calendar data folder in .mozilla/seamonkey/extensions needs to be renamed prior to iceape install. Will verify that tomorrow AM (limited bandwidth). Otherwise, an updated lightning extension works well.
Whiteboard: MGA4TOO mga4-64-ok mga5-64-ok => MGA4TOO mga4-64-ok mga5-64-ok mga4-32-ok
Correction: .mozilla/seamonkey/{blah blah blah}.default
Whiteboard: MGA4TOO mga4-64-ok mga5-64-ok mga4-32-ok => MGA4TOO mga4-64-ok mga5-64-ok mga5-32-ok
Advisory uploaded. Validate it when you're happy with it please Bill
Whiteboard: MGA4TOO mga4-64-ok mga5-64-ok mga5-32-ok => MGA4TOO advisory mga4-64-ok mga5-64-ok mga5-32-ok
I'm happy with it and since this is the first update from upstream since March due to issues with the build system, We should probably push ASAP. Once I get the built-in calendar stuff straightened out, I'll post the solution in this bug report. I had a similar issue when Thunderbird 38 came out, so I'm probably not the only one! mga4-32 tested as above, all ok. Validating.
Keywords: (none) => validated_updateWhiteboard: MGA4TOO advisory mga4-64-ok mga5-64-ok mga5-32-ok => MGA4TOO advisory mga4-64-ok mga5-64-ok mga5-32-ok mga4-32-okCC: (none) => sysadmin-bugs
(In reply to Bill Wilkinson from comment #7) > Once I get the built-in calendar stuff straightened out, I'll post the > solution in this bug report. I had a similar issue when Thunderbird 38 came > out, so I'm probably not the only one! I enabled the calendar (lightning) in iceape 2.15-0.b5.1.mga3 but when I tested it later it didn't work so I disabled it again in iceape 2.31-1.mga5. Neither 2.33.1 nor 2.35 should have a bundled lightning calendar component: the lightning extension needs to be installed for calendar features in mailnews.
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0342.html
Status: NEW => RESOLVEDResolution: (none) => FIXED
(In reply to Christiaan Welvaart from comment #8) > (In reply to Bill Wilkinson from comment #7) > > Once I get the built-in calendar stuff straightened out, I'll post the > > solution in this bug report. I had a similar issue when Thunderbird 38 came > > out, so I'm probably not the only one! > > I enabled the calendar (lightning) in iceape 2.15-0.b5.1.mga3 but when I > tested it later it didn't work so I disabled it again in iceape 2.31-1.mga5. > Neither 2.33.1 nor 2.35 should have a bundled lightning calendar component: > the lightning extension needs to be installed for calendar features in > mailnews. I thought I saw that it was just added in to the final release cycle this time. It took me a while to get it working under Thunderbird, and I think it was with the procedure I mentioned above, namely: remove lightning prior to iceape install and remove/rename the calendar directory before running iceape (can be done at the same time as lightning removal).
URL: (none) => http://lwn.net/Vulnerabilities/656896/