what you don't know can hurt you

Ubuntu Security Notice USN-1548-1

Ubuntu Security Notice USN-1548-1
Posted Aug 30, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1548-1 - Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel Holbert discovered memory safety issues affecting Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Abhishek Arya discovered multiple use-after-free vulnerabilities. If the user were tricked into opening a specially crafted page, an attacker could exploit these to cause a denial of service via application crash, or potentially execute code with the privileges of the user invoking Firefox. Various other issues were also addressed.

tags | advisory, denial of service, vulnerability
systems | linux, ubuntu
advisories | CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964, CVE-2012-1956, CVE-2012-3965, CVE-2012-3966, CVE-2012-3970, CVE-2012-3971, CVE-2012-3972, CVE-2012-3973, CVE-2012-3975, CVE-2012-3976, CVE-2012-3978, CVE-2012-3980, CVE-2012-1956, CVE-2012-1970, CVE-2012-1971, CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976
MD5 | 139786f07550858f55d28618106168cf

Ubuntu Security Notice USN-1548-1

Change Mirror Download
============================================================================
Ubuntu Security Notice USN-1548-1
August 29, 2012

firefox vulnerabilities
============================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS

Summary:

Multiple security issues were fixed in Firefox.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

Gary Kwong, Christian Holler, Jesse Ruderman, Steve Fink, Bob Clary, Andrew
Sutherland, Jason Smith, John Schoenick, Vladimir Vukicevic and Daniel
Holbert discovered memory safety issues affecting Firefox. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to cause a denial of service via application crash, or
potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-1970, CVE-2012-1971)

Abhishek Arya discovered multiple use-after-free vulnerabilities. If the
user were tricked into opening a specially crafted page, an attacker could
exploit these to cause a denial of service via application crash, or
potentially execute code with the privileges of the user invoking Firefox.
(CVE-2012-1972, CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976,
CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959, CVE-2012-3960,
CVE-2012-3961, CVE-2012-3962, CVE-2012-3963, CVE-2012-3964)

Mariusz Mlynsk discovered that it is possible to shadow the location object
using Object.defineProperty. This could potentially result in a cross-site
scripting (XSS) attack against plugins. With cross-site scripting
vulnerabilities, if a user were tricked into viewing a specially crafted
page, a remote attacker could exploit this to modify the contents or steal
confidential data within the same domain. (CVE-2012-1956)

Mariusz Mlynski discovered an escalation of privilege vulnerability through
about:newtab. This could possibly lead to potentially code execution with
the privileges of the user invoking Firefox. (CVE-2012-3965)

Fr=C3=A9d=C3=A9ric Hoguin discovered that bitmap format images with a negative height
could potentially result in memory corruption. If the user were tricked
into opening a specially crafted image, an attacker could exploit
this to cause a denial of service via application crash, or potentially
execute code with the privileges of the user invoking Firefox.
(CVE-2012-3966)

It was discovered that Firefox's WebGL implementation was vulnerable to
multiple memory safety issues. If the user were tricked into opening a
specially crafted page, an attacker could exploit these to cause a denial
of service via application crash, or potentially execute code with the
privileges of the user invoking Firefox. (CVE-2012-3967, CVE-2012-3968)

Arthur Gerkis discovered multiple memory safety issues in Firefox's
Scalable Vector Graphics (SVG) implementation. If the user were tricked
into opening a specially crafted image, an attacker could exploit these to
cause a denial of service via application crash, or potentially execute
code with the privileges of the user invoking Firefox. (CVE-2012-3969,
CVE-2012-3970)

Christoph Diehl discovered multiple memory safety issues in the bundled
Graphite 2 library. If the user were tricked into opening a specially
crafted page, an attacker could exploit these to cause a denial of service
via application crash, or potentially execute code with the privileges of
the user invoking Firefox. (CVE-2012-3971)

Nicolas Gr=C3=A9goire discovered an out-of-bounds read in the format-number
feature of XSLT. This could potentially cause inaccurate formatting of
numbers and information leakage. (CVE-2012-3972)

Mark Goodwin discovered that under certain circumstances, Firefox's
developer tools could allow remote debugging even when disabled.
(CVE-2012-3973)

It was discovered that when the DOMParser is used to parse text/html data
in a Firefox extension, linked resources within this HTML data will be
loaded. If the data being parsed in the extension is untrusted, it could
lead to information leakage and potentially be combined with other attacks
to become exploitable. (CVE-2012-3975)

Mark Poticha discovered that under certain circumstances incorrect SSL
certificate information can be displayed on the addressbar, showing the SSL
data for a previous site while another has been loaded. This could
potentially be used for phishing attacks. (CVE-2012-3976)

It was discovered that, in some instances, certain security checks in the
location object could be bypassed. This could allow for the loading of
restricted content and can potentially be combined with other issues to
become exploitable. (CVE-2012-3978)

Colby Russell discovered that eval in the web console can execute injected
code with chrome privileges, leading to the running of malicious code in a
privileged context. If the user were tricked into opening a specially
crafted page, an attacker could exploit this to cause a denial of service
via application crash, or potentially execute code with the privileges of
the user invoking Firefox. (CVE-2012-3980)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
firefox 15.0+build1-0ubuntu0.12.04.1

Ubuntu 11.10:
firefox 15.0+build1-0ubuntu0.11.10.1

Ubuntu 11.04:
firefox 15.0+build1-0ubuntu0.11.04.2

Ubuntu 10.04 LTS:
firefox 15.0+build1-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1548-1
CVE-2012-1956, CVE-2012-1970, CVE-2012-1971, CVE-2012-1972,
CVE-2012-1973, CVE-2012-1974, CVE-2012-1975, CVE-2012-1976,
CVE-2012-3956, CVE-2012-3957, CVE-2012-3958, CVE-2012-3959,
CVE-2012-3960, CVE-2012-3961, CVE-2012-3962, CVE-2012-3963,
CVE-2012-3964, CVE-2012-3965, CVE-2012-3966, CVE-2012-3967,
CVE-2012-3968, CVE-2012-3969, CVE-2012-3970, CVE-2012-3971,
CVE-2012-3972, CVE-2012-3973, CVE-2012-3975, CVE-2012-3976,
CVE-2012-3978, CVE-2012-3980, https://launchpad.net/bugs/1041620

Package Information:
https://launchpad.net/ubuntu/+source/firefox/15.0+build1-0ubuntu0.12.04.1
https://launchpad.net/ubuntu/+source/firefox/15.0+build1-0ubuntu0.11.10.1
https://launchpad.net/ubuntu/+source/firefox/15.0+build1-0ubuntu0.11.04.2
https://launchpad.net/ubuntu/+source/firefox/15.0+build1-0ubuntu0.10.04.1

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close