[arch-security] [ASA-201505-7] firefox: multiple issues

Wed May 13 08:24:45 UTC 2015

Arch Linux Security Advisory ASA-201505-7
=========================================

Severity: Critical
Date    : 2015-05-13
CVE-ID  : CVE-2015-2708 CVE-2015-2709 CVE-2015-2710 CVE-2015-2711
CVE-2015-2712 CVE-2015-2713 CVE-2015-2715 CVE-2015-2716 CVE-2015-2717
CVE-2015-2718
Package : firefox
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package firefox before version 38.0-1 is vulnerable to multiple
issues including remote code execution.

Resolution
==========

Upgrade to 38.0-1.

# pacman -Syu "firefox>=38.0-1"

The problem has been fixed upstream in version 38.0.

Workaround
==========

None.

Description
===========

- CVE-2015-2708 (Memory safety bugs fixed in Firefox ESR 31.7 and
Firefox 38):

Jesse Ruderman, Mats Palmgren, Byron Campen, and Steve Fink reported
memory safety problems and crashes that affect Firefox ESR 31.6 and
Firefox 37.

- CVE-2015-2709 (Memory safety bugs fixed in Firefox 38):

Gary Kwong, Andrew McCreight, Christian Holler, Jesse Ruderman, Mats
Palmgren, Jon Coppeard, and Milan Sreckovic reported memory safety
problems and crashes that affect Firefox 37.

- CVE-2015-2710 (Buffer overflow with SVG content and CSS):

Using the Address Sanitizer tool, security researcher Atte Kettunen
found a buffer overflow during the rendering of SVG format graphics when
combined with specific CSS properties on a page. This results in a
potentially exploitable crash.

- CVE-2015-2711 (Referrer policy ignored when links opened by
middle-click and context menu):

Security researcher Alex Verstak reported that <meta name="referrer"> is
ignored when a link is opened through the context menu or a middle-click
by mouse. This means that, in some situations, the referrer policy is
ignored when opening links in new tabs and may cause some pages to open
without an HTTP Referer header being set according to the author's
intended policy.

- CVE-2015-2712 (Out-of-bounds read and write in asm.js validation):

Security researcher Dougall Johnson reported an out-of-bounds read and
write in asm.js during JavaScript validation due to an error in how heap
lengths are defined. This results in a potentially exploitable crash and
could allow for the reading of random memory which may contain sensitive
data.

- CVE-2015-2713 (Use-after-free during text processing with vertical
text enabled):

Security researcher Scott Bell used the Address Sanitizer tool to
discover a use-after-free error during the processing of text when
vertical text is enabled. This leads to a potentially exploitable crash.

- CVE-2015-2715 (Use-after-free due to Media Decoder Thread creation
during shutdown):

Security researchers Tyson Smith and Jesse Schwartzentruber reported a
use-after-free during the shutdown process. This was caused by a race
condition when media decoder threads are created during the shutdown
process in some circumstances. This leads to a potentially exploitable
crash when triggered.

- CVE-2015-2716 (Buffer overflow when parsing compressed XML):

Security researcher Ucha Gobejishvili used the Address Sanitizer tool to
find a buffer overflow while parsing compressed XML content. This was
due to an error in how buffer space is created and modified when
handling large amounts of XML data. This results in a potentially
exploitable crash.

- CVE-2015-2717 (Buffer overflow and out-of-bounds read while parsing
MP4 video metadata):

Security researcher laf.intel reported a buffer overflow and
out-of-bounds read in the libstagefright library while parsing invalid
metadata in MP4 video files. This can lead to a potentially exploitable
crash.

- CVE-2015-2718 (Untrusted site hosting trusted page can intercept
webchannel responses):

Mozilla developer Mark Hammond reported a flaw in how WebChannel.jsm
handles message traffic. He found that when a trusted page is hosted
within an <iframe> on an untrusted third-party untrusted framing page,
the untrusted page could intercept webchannel responses meant for the
trusted page, bypassing origin restrictions.

Impact
======

A remote attacker can execute arbitrary code with the permission of the
current firefox user by tricking him into visiting a website.

References
==========

https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/#firefox38
https://access.redhat.com/security/cve/CVE-2015-2708
https://access.redhat.com/security/cve/CVE-2015-2709
https://access.redhat.com/security/cve/CVE-2015-2710
https://access.redhat.com/security/cve/CVE-2015-2711
https://access.redhat.com/security/cve/CVE-2015-2712
https://access.redhat.com/security/cve/CVE-2015-2713
https://access.redhat.com/security/cve/CVE-2015-2715
https://access.redhat.com/security/cve/CVE-2015-2716
https://access.redhat.com/security/cve/CVE-2015-2717
https://access.redhat.com/security/cve/CVE-2015-2718

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20150513/b5a2275b/attachment.asc>