ArchLinux: 201505-7: firefox: multiple issues
Summary
- CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and
Firefox 38):
Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported
memory safety problems and crashes that affect Firefox ESR 31.6 and
Firefox 37.
- CVE-2015-2709 (Memory safety bugs fixed in Firefox 38):
Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats
Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety
problems and crashes that affect Firefox 37.
- CVE-2015-2710 (Buffer overflow with SVG content and CSS):
Using the Address Sanitizer tool, security researcher Atte Kettunen
found a buffer overflow during the rendering of SVG format graphics when
combined with specific CSS properties on a page. This results in a
potentially exploitable crash.
- CVE-2015-2711 (Referrer policy ignored when links opened by
middle-click and context menu):
Security researcher Alex Verstak reported that is
ignored when a link is opened through the context menu or a middle-click
by mouse. This means that, in some situations, the referrer policy is
ignored when opening links in new tabs and may cause some pages to open
without an HTTP Referer header being set according to the author's
intended policy.
- CVE-2015-2712 (Out-of-bounds read and write in asm.js validation):
Security researcher Dougall Johnson reported an out-of-bounds read and
write in asm.js during JavaScript validation due to an error in how heap
lengths are defined. This results in a potentially exploitable crash and
could allow for the reading of random memory which may contain sensitive
data.
- CVE-2015-2713 (Use-after-free during text processing with vertical
text enabled):
Security researcher Scott Bell used the Address Sanitizer tool to
discover a use-after-free error during the processing of text when
vertical text is enabled. This leads to a potentially exploitable crash.
- CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation
during shutdown):
Security researchers Tyson Smith and Jesse Schwartzentruber reported a
use-after-free during the shutdown process. This was caused by a race
condition when media decoder threads are created during the shutdown
process in some circumstances. This leads to a potentially exploitable
crash when triggered.
- CVE-2015-2716 (Buffer overflow when parsing compressed XML):
Security researcher Ucha Gobejishvili used the Address Sanitizer tool to
find a buffer overflow while parsing compressed XML content. This was
due to an error in how buffer space is created and modified when
handling large amounts of XML data. This results in a potentially
exploitable crash.
- CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing
MP4 video metadata):
Security researcher laf.intel reported a buffer overflow and
out-of-bounds read in the libstagefright library while parsing invalid
metadata in MP4 video files. This can lead to a potentially exploitable
crash.
- CVE-2015-2718 (Untrusted site hosting trusted page can intercept
webchannel responses):
Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm
handles message traffic. He found that when a trusted page is hosted
within an iframe on an untrusted third-party untrusted framing page,
the untrusted page could intercept webchannel responses meant for the
trusted page, bypassing origin restrictions.
Resolution
Upgrade to 38.0-1.
# pacman -Syu "firefox>=38.0-1"
The problem has been fixed upstream in version 38.0.
References
https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox38 https://access.redhat.com/security/cve/CVE-2015-2708 https://access.redhat.com/security/cve/CVE-2015-2709 https://access.redhat.com/security/cve/CVE-2015-2710 https://access.redhat.com/security/cve/CVE-2015-2711 https://access.redhat.com/security/cve/CVE-2015-2712 https://access.redhat.com/security/cve/CVE-2015-2713 https://access.redhat.com/security/cve/CVE-2015-2715 https://access.redhat.com/security/cve/CVE-2015-2716 https://access.redhat.com/security/cve/CVE-2015-2717 https://access.redhat.com/security/cve/CVE-2015-2718
Workaround
None.
