USN-2329-1: Firefox vulnerabilities
Ubuntu Security Notice USN-2329-1
2nd September, 2014
firefox vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS
Summary
Firefox could be made to crash or run programs as your login if it opened a malicious website.
Software description
- firefox - Mozilla Open Source web browser
Details
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong,
Jesse Ruderman, JW Wang and David Weir discovered multiple memory safety
issues in Firefox. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit these to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Firefox. (CVE-2014-1553,
CVE-2014-1554, CVE-2014-1562)
Abhishek Arya discovered a use-after-free during DOM interactions with
SVG. If a user were tricked in to opening a specially crafted page, an
attacker could potentially exploit this to cause a denial of service via
application crash or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2014-1563)
Michal Zalewski discovered that memory is not initialized properly during
GIF rendering in some circumstances. If a user were tricked in to opening
a specially crafted page, an attacker could potentially exploit this to
steal confidential information. (CVE-2014-1564)
Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a
user were tricked in to opening a specially crafted website, an attacker
could potentially exploit this to cause a denial of service via
application crash or steal confidential information. (CVE-2014-1565)
A use-after-free was discovered during text layout in some circumstances.
If a user were tricked in to opening a specially crafted website, an
attacker could potentially exploit this to cause a denial of service via
application crash or execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2014-1567)
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 14.04 LTS:
- firefox 32.0+build1-0ubuntu0.14.04.1
- Ubuntu 12.04 LTS:
- firefox 32.0+build1-0ubuntu0.12.04.1
To update your system, please follow these instructions: http://bit.ly/1aJDvTw.
After a standard system update you need to restart Firefox to make
all the necessary changes.
References
CVE-2014-1553, CVE-2014-1554, CVE-2014-1562, CVE-2014-1563, CVE-2014-1564, CVE-2014-1565, CVE-2014-1567
from Ubuntu Security Notices http://bit.ly/1trvjV7