[arch-security] [ASA-201503-21] firefox: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201503-21
==========================================

Severity: Critical
Date    : 2015-03-21
CVE-ID  : CVE-2015-0817 CVE-2015-0818
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package firefox before version 36.0.3-1 is vulnerable to multiple
issues, including same-origin policy bypass and arbitrary remote code
execution.

Resolution
==========

Upgrade to 36.0.3-1.

# pacman -Syu "firefox>=36.0.3-1"

The problem has been fixed upstream in version 36.0.3.

Workaround
==========

None.

Description
===========

- CVE-2015-0817 (arbitrary remote code execution):

Security researcher ilxu1a reported, through HP Zero Day Initiative's
Pwn2Own contest, a flaw in Mozilla's implementation of typed array
bounds checking in JavaScript just-in-time compilation (JIT) and its
management of bounds checking for heap access. This flaw can be
leveraged into the reading and writing of memory allowing for arbitary
code execution on the local system.

- CVE-2015-0818 (same-origin policy bypass):

Security researcher Mariusz Mlynski reported, through HP Zero Day
Initiative's Pwn2Own contest, a method to run arbitrary scripts in a
privileged context. This bypassed the same-origin policy protections by
using a flaw in the processing of SVG format content navigation.

Impact
======

A remote attacker can bypass the same-origin policy or execute arbitrary
code with the privilege of the browser.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2015-28/
https://www.mozilla.org/en-US/security/advisories/mfsa2015-29/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150321/d54dfcee/attachment.asc>