Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Oxygen-GTK3 (Aktualisierung)
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Oxygen-GTK3 (Aktualisierung)
ID: USN-2936-2
Distribution: Ubuntu
Plattformen: Ubuntu 12.04 LTS
Datum: Mo, 2. Mai 2016, 23:12
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2811
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2816
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2817
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2814
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2820
Applikationen: Oxygen-GTK3
Update von: Mehrere Probleme in Mozilla Firefox

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============7345239570864184511==
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature";
boundary="2w6Oe1c9JAtVoLqKC6gPvlWIVRFMkkBTF"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--2w6Oe1c9JAtVoLqKC6gPvlWIVRFMkkBTF
Content-Type: multipart/mixed;
boundary="JnIIs95QSf2pEUm9dDFO1dEUrRTeB2Tk5"
From: Chris Coulson <chris.coulson@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <26923fef-d7d3-3db1-9622-01a232b98874@canonical.com>
Subject: [USN-2936-2] Oxygen-GTK3 update

--JnIIs95QSf2pEUm9dDFO1dEUrRTeB2Tk5
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2936-2
May 02, 2016

oxygen-gtk3 update
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

USN-2936-1 caused Firefox to crash on startup with the Oxygen GTK theme

Software Description:
- oxygen-gtk3: Oxygen widget theme for GTK3-based applications

Details:

USN-2936-1 fixed vulnerabilities in Firefox. The update caused Firefox to
crash on startup with the Oxygen GTK theme due to a pre-existing bug in
the Oxygen-GTK3 theme engine. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman,
Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup,
Andrew McCreight, and Steve Fink discovered multiple memory safety issues
in Firefox. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit these to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806,
CVE-2016-2807)

An invalid write was discovered when using the JavaScript .watch() method in
some circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking Firefox. (CVE-2016-2808)

Looben Yang discovered a use-after-free and buffer overflow in service
workers. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit these to cause a denial of service
via application crash, or execute arbitrary code with the privileges of
the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812)

Sascha Just discovered a buffer overflow in libstagefright in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking Firefox. (CVE-2016-2814)

Muneaki Nishimura discovered that CSP is not applied correctly to web
content sent with the multipart/x-mixed-replace MIME type. An attacker
could potentially exploit this to conduct cross-site scripting (XSS)
attacks when they would otherwise be prevented. (CVE-2016-2816)

Muneaki Nishimura discovered that the chrome.tabs.update API for web
extensions allows for navigation to javascript: URLs. A malicious
extension could potentially exploit this to conduct cross-site scripting
(XSS) attacks. (CVE-2016-2817)

Mark Goodwin discovered that about:healthreport accepts certain events
from any content present in the remote-report iframe. If another
vulnerability allowed the injection of web content in the remote-report
iframe, an attacker could potentially exploit this to change the user's
sharing preferences. (CVE-2016-2820)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
gtk3-engines-oxygen 1.0.2-0ubuntu3

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2936-2
http://www.ubuntu.com/usn/usn-2936-1
https://launchpad.net/bugs/1575781

Package Information:
https://launchpad.net/ubuntu/+source/oxygen-gtk3/1.0.2-0ubuntu3



--JnIIs95QSf2pEUm9dDFO1dEUrRTeB2Tk5--

--2w6Oe1c9JAtVoLqKC6gPvlWIVRFMkkBTF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJXJ7+KAAoJEGEfvezVlG4PzfoH/3ReZBhjjI3iIe4deOTpx0jN
hjJQuUekgCs/W8+EoIs+/Gd2sd96qq6wyZAAZR3sQcGpKMKDmFXBOqtixPbn1fcH
t/3Q8rafTxAR++J3nvQwZAhsn9Oo/swipwxcDG0Bucx4T1U4N6eX0f2KzvwJw0ED
/w5GD4ST5wtbAGsx2xCrO/CadZp3l6xoYhOUcqmkNdD9Ke1X20sa3tWM5azpAXT3
v2fJmT+m3Is6FjQFBkSyH7WGDdsTOClME3sU2zJaBMLU3BHHHPd+eEb20FbtDyNL
0JQuXHPKaghdq+Ucmg27Y/SduPdWCloyBkLpHs+sg6by7Gke1t4FnFFpO3Bmy10=
=5+Zq
-----END PGP SIGNATURE-----

--2w6Oe1c9JAtVoLqKC6gPvlWIVRFMkkBTF--


--===============7345239570864184511==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============7345239570864184511==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung