This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============5593873913412499395== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="NB9VB0L0lq3pB5tgvSItXA9CqMFnf9aLc"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --NB9VB0L0lq3pB5tgvSItXA9CqMFnf9aLc Content-Type: multipart/mixed; boundary="43h5nHa8n3K6u62BvPOuuMFPfcsgnsCGd" From: Chris Coulson <chris.coulson@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: ubuntu-security-announce@lists.ubuntu.com Message-ID: <a5c141fe-3db8-2d97-13fb-f6b7d582655e@canonical.com> Subject: [USN-2993-1] Firefox vulnerabilities
--43h5nHa8n3K6u62BvPOuuMFPfcsgnsCGd Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-2993-1 June 09, 2016
firefox vulnerabilities ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS - Ubuntu 15.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS
Summary:
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Software Description: - firefox: Mozilla Open Source web browser
Details:
Christian Holler, Gary Kwong, Jesse Ruderman, Tyson Smith, Timothy Nikkel, Sylvestre Ledru, Julian Seward, Olli Pettay, Karl Tomlinson, Christoph Diehl, Julian Hector, Jan de Mooij, Mats Palmgren, and Tooru Fujisawa discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2815, CVE-2016-2818)
A buffer overflow was discovered when parsing HTML5 fragments in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2819)
A use-after-free was discovered in contenteditable mode in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2821)
Jordi Chancel discovered a way to use a persistent menu within a <select> element and place this in an arbitrary location. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to spoof the addressbar contents. (CVE-2016-2822)
Armin Razmdjou that the location.host property can be set to an arbitrary string after creating an invalid data: URI. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass some same-origin protections. (CVE-2016-2825)
A use-after-free was discovered when processing WebGL content in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2828)
Tim McCormack discovered that the permissions notification can show the wrong icon when a page requests several permissions in quick succession. An attacker could potentially exploit this by tricking the user in to giving consent for access to the wrong resource. (CVE-2016-2829)
It was discovered that a pointerlock can be created in a fullscreen window without user consent in some circumstances, and this pointerlock cannot be cancelled without quitting Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service or conduct clickjacking attacks. (CVE-2016-2831)
John Schoenick discovered that CSS pseudo-classes can leak information about plugins that are installed but disabled. An attacker could potentially exploit this to fingerprint users. (CVE-2016-2832)
Matt Wobensmith discovered that Content Security Policy (CSP) does not block the loading of cross-domain Java applets when specified by policy. An attacker could potentially exploit this to bypass CSP protections and conduct cross-site scripting (XSS) attacks. (CVE-2016-2833)
In addition, multiple unspecified security issues were discovered in NSS. (CVE-2016-2834)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 16.04 LTS: firefox 47.0+build3-0ubuntu0.16.04.1
Ubuntu 15.10: firefox 47.0+build3-0ubuntu0.15.10.1
Ubuntu 14.04 LTS: firefox 47.0+build3-0ubuntu0.14.04.1
Ubuntu 12.04 LTS: firefox 47.0+build3-0ubuntu0.12.04.1
After a standard system update you need to restart Firefox to make all the necessary changes.
References: http://www.ubuntu.com/usn/usn-2993-1 CVE-2016-2815, CVE-2016-2818, CVE-2016-2819, CVE-2016-2821, CVE-2016-2822, CVE-2016-2825, CVE-2016-2828, CVE-2016-2829, CVE-2016-2831, CVE-2016-2832, CVE-2016-2833, CVE-2016-2834
Package Information: https://launchpad.net/ubuntu/+source/firefox/47.0+build3-0ubuntu0.16.04.1 https://launchpad.net/ubuntu/+source/firefox/47.0+build3-0ubuntu0.15.10.1 https://launchpad.net/ubuntu/+source/firefox/47.0+build3-0ubuntu0.14.04.1 https://launchpad.net/ubuntu/+source/firefox/47.0+build3-0ubuntu0.12.04.1
--43h5nHa8n3K6u62BvPOuuMFPfcsgnsCGd--
--NB9VB0L0lq3pB5tgvSItXA9CqMFnf9aLc Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2
iQEcBAEBCAAGBQJXWYmKAAoJEGEfvezVlG4PwaUIAI+MWPPe/+Z11pSFTlNNchUW I4TTrrYOIz/2D3Zm+qMFFMyh2FZCcLuIbIPKOdmewRNkI8BdGvzAIvGdxPGxZylI u3pZRsCVlMna1TYX2XsldkUSkPiuL2Gn9rS+HEZ7KuW5i98JR6s9xn0Ad2WR7c7W ygABN8T64WSof0zEhpm1O9t8E9n8BunY93zCSF9r53N/qClT3+bJSPiaIjtR05ZN y2uo3EeSgxhfDHeK9Y19zz/8ApikidYmO3XLVzQ4XJSGx1HlvF8sN9PFk6pgnxnX fQa6WJlKxkdibbHC1AMhqVzkTnm1B/h4XauvEotO7n+5yXkt76b04+R7ff/fXXg= =Szqe -----END PGP SIGNATURE-----
--NB9VB0L0lq3pB5tgvSItXA9CqMFnf9aLc--
--===============5593873913412499395== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============5593873913412499395==--
|