LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: April 7th, 2014
Linux Advisory Watch: April 4th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Ubuntu: 1729-2: Firefox regression Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Ubuntu Due to a regression, Firefox might crash or freeze under normal use.
==========================================================================
Ubuntu Security Notice USN-1729-2
March 01, 2013

firefox regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10

Summary:

Due to a regression, Firefox might crash or freeze under normal use.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

USN-1729-1 fixed vulnerabilities in Firefox. This update introduced a
regression which sometimes resulted in freezes and crashes when using
multiple tabs with images displayed. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight,
 Joe Drew, Wayne Mery, Alon Zakai, Christian Holler, Gary Kwong, Luke
 Wagner, Terrence Cole, Timothy Nikkel, Bill McCloskey, and Nicolas Pierron
 discovered multiple memory safety issues affecting Firefox. If the user
 were tricked into opening a specially crafted page, an attacker could
 possibly exploit these to cause a denial of service via application crash.
 (CVE-2013-0783, CVE-2013-0784)

 Atte Kettunen discovered that Firefox could perform an out-of-bounds read
 while rendering GIF format images. An attacker could exploit this to crash
 Firefox. (CVE-2013-0772)

 Boris Zbarsky discovered that Firefox did not properly handle some wrapped
 WebIDL objects. If the user were tricked into opening a specially crafted
 page, an attacker could possibly exploit this to cause a denial of service
 via application crash, or potentially execute code with the privileges of
 the user invoking Firefox. (CVE-2013-0765)

 Bobby Holley discovered vulnerabilities in Chrome Object Wrappers (COW) and
 System Only Wrappers (SOW). If a user were tricked into opening a specially
 crafted page, a remote attacker could exploit this to bypass security
 protections to obtain sensitive information or potentially execute code
 with the privileges of the user invoking Firefox. (CVE-2013-0773)

 Frederik Braun discovered that Firefox made the location of the active
 browser profile available to JavaScript workers. (CVE-2013-0774)

 A use-after-free vulnerability was discovered in Firefox. An attacker could
 potentially exploit this to execute code with the privileges of the user
 invoking Firefox. (CVE-2013-0775)

 Michal Zalewski discovered that Firefox would not always show the correct
 address when cancelling a proxy authentication prompt. A remote attacker
 could exploit this to conduct URL spoofing and phishing attacks.
 (CVE-2013-0776)

 Abhishek Arya discovered several problems related to memory handling. If
 the user were tricked into opening a specially crafted page, an attacker
 could possibly exploit these to cause a denial of service via application
 crash, or potentially execute code with the privileges of the user invoking
 Firefox. (CVE-2013-0777, CVE-2013-0778, CVE-2013-0779, CVE-2013-0780,
 CVE-2013-0781, CVE-2013-0782)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  firefox                         19.0+build1-0ubuntu0.12.10.2

Ubuntu 12.04 LTS:
  firefox                         19.0+build1-0ubuntu0.12.04.2

Ubuntu 11.10:
  firefox                         19.0+build1-0ubuntu0.11.10.2

After a standard system update you need to restart Firefox to make all the
necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1729-2
  http://www.ubuntu.com/usn/usn-1729-1
  https://launchpad.net/bugs/1134409

Package Information:
  https://launchpad.net/ubuntu/+source/firefox/19.0+build1-0ubuntu0.12.10.2
  https://launchpad.net/ubuntu/+source/firefox/19.0+build1-0ubuntu0.12.04.2
  https://launchpad.net/ubuntu/+source/firefox/19.0+build1-0ubuntu0.11.10.2





 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Weekend Edition
Heartbleed: Security experts reality-check the 3 most hysterical fears
Open source trounces proprietary software for code defects, Coverity analysis finds
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.