Arch Linux Security Advisory ASA-201505-7 ========================================= Severity: Critical Date : 2015-05-13 CVE-ID : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711 CVE-2015-2712 CVE-2015-2713 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717 CVE-2015-2718 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 38.0-1 is vulnerable to multiple issues including remote code execution. Resolution ========== Upgrade to 38.0-1. # pacman -Syu "firefox>=38.0-1" The problem has been fixed upstream in version 38.0. Workaround ========== None. Description =========== - CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and Firefox 38): Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported memory safety problems and crashes that affect Firefox ESR 31.6 and Firefox 37. - CVE-2015-2709 (Memory safety bugs fixed in Firefox 38): Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety problems and crashes that affect Firefox 37. - CVE-2015-2710 (Buffer overflow with SVG content and CSS): Using the Address Sanitizer tool, security researcher Atte Kettunen found a buffer overflow during the rendering of SVG format graphics when combined with specific CSS properties on a page. This results in a potentially exploitable crash. - CVE-2015-2711 (Referrer policy ignored when links opened by middle-click and context menu): Security researcher Alex Verstak reported that <meta name="referrer"> is ignored when a link is opened through the context menu or a middle-click by mouse. This means that, in some situations, the referrer policy is ignored when opening links in new tabs and may cause some pages to open without an HTTP Referer header being set according to the author's intended policy. - CVE-2015-2712 (Out-of-bounds read and write in asm.js validation): Security researcher Dougall Johnson reported an out-of-bounds read and write in asm.js during JavaScript validation due to an error in how heap lengths are defined. This results in a potentially exploitable crash and could allow for the reading of random memory which may contain sensitive data. - CVE-2015-2713 (Use-after-free during text processing with vertical text enabled): Security researcher Scott Bell used the Address Sanitizer tool to discover a use-after-free error during the processing of text when vertical text is enabled. This leads to a potentially exploitable crash. - CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation during shutdown): Security researchers Tyson Smith and Jesse Schwartzentruber reported a use-after-free during the shutdown process. This was caused by a race condition when media decoder threads are created during the shutdown process in some circumstances. This leads to a potentially exploitable crash when triggered. - CVE-2015-2716 (Buffer overflow when parsing compressed XML): Security researcher Ucha Gobejishvili used the Address Sanitizer tool to find a buffer overflow while parsing compressed XML content. This was due to an error in how buffer space is created and modified when handling large amounts of XML data. This results in a potentially exploitable crash. - CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing MP4 video metadata): Security researcher laf.intel reported a buffer overflow and out-of-bounds read in the libstagefright library while parsing invalid metadata in MP4 video files. This can lead to a potentially exploitable crash. - CVE-2015-2718 (Untrusted site hosting trusted page can intercept webchannel responses): Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm handles message traffic. He found that when a trusted page is hosted within an <iframe> on an untrusted third-party untrusted framing page, the untrusted page could intercept webchannel responses meant for the trusted page, bypassing origin restrictions. Impact ====== A remote attacker can execute arbitrary code with the permission of the current firefox user by tricking him into visiting a website. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefo... https://access.redhat.com/security/cve/CVE-2015-2708 https://access.redhat.com/security/cve/CVE-2015-2709 https://access.redhat.com/security/cve/CVE-2015-2710 https://access.redhat.com/security/cve/CVE-2015-2711 https://access.redhat.com/security/cve/CVE-2015-2712 https://access.redhat.com/security/cve/CVE-2015-2713 https://access.redhat.com/security/cve/CVE-2015-2715 https://access.redhat.com/security/cve/CVE-2015-2716 https://access.redhat.com/security/cve/CVE-2015-2717 https://access.redhat.com/security/cve/CVE-2015-2718