bugtraq - [SECURITY] [DSA 3050-1] iceweasel security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20141018173154.GA2347@pisco.westfalen.local>
Date: Sat, 18 Oct 2014 19:31:55 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3050-1] iceweasel security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3050-1                   security@...ian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
October 15, 2014                       http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : iceweasel
CVE ID         : CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 
                 CVE-2014-1581 CVE-2014-1583 CVE-2014-1585 CVE-2014-1586

Multiple security issues have been found in Iceweasel, Debian's version 
of the Mozilla Firefox web browser: Multiple memory safety errors, buffer
overflows, use-after-frees and other implementation errors may lead to 
the execution of arbitrary code, denial of service, the bypass of the
same-origin policy or a loss of privacy.

This update updates Iceweasel to the ESR31 series of Firefox. The new
release introduces a new user interface.

In addition, this update also disables SSLv3.

For the stable distribution (wheezy), these problems have been fixed in
version 31.2.0esr-2~deb7u1.

For the unstable distribution (sid), these problems have been fixed in
version 31.2.0esr-1.

For the experimental distribution, these problems have been fixed in
version 33.0-1.

We recommend that you upgrade your iceweasel packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJUQqPeAAoJEBDCk7bDfE42R1cP/R7torvz9lRWx49TW6D09BlW
gcrVBKNANH9ofr7L2G8zKJVBe8M0TWCJiFUKRy3+jRG7NbwLHaFIVpcfIBpaIpij
4jXFH7zXVcc0cCPmyPjWshj700tbRWBuCajHVKP+TWWE6wz9sZZxg7K7VLde5fAJ
TIrBMmaMm0mU+eGisCSDy2dqARgijetcZPBVpEqGDWEbuLv8Tpx/JKnEuWEaP4j0
uxB2tUcEPxSUCA2A5mwn5rSPBSxREdJaZ4zpCuIi+iefLvrVQcoYsDjXhpkJoRuH
aQ48c0E+7yk//Xzb9w1Ek99/paCBkVaqPayr5nDjEvdpYozP8d7sfz3FkXHDdbSp
ZPNYqj+KJMcEXzKxJD44SpFV9rRMqO5Uc0V1wNa8273hqoC0ajjlY9R3jPMrKQUP
gRfIGa87PKALk/aAm7fFvl0ULlvHwfzq27gf3lr3VRgBDtfwBkQXWC+BtOXq7zH6
Pca+g4x9Fg5oD4GmbzRWp68HybcX9GGx2eh0clP6JmXkw24E5O0vFPL+z01bpACW
x2VujeojofKowNb5j+FpTvA/GO87JLgvT72plYING+x7lMjI6ledoOwJKTI4oUl8
a8an2uUEDUXmCYmM39mjIRAkT3lbHSuiFZFMieVZVdVbxL2+pj9mZXUhsltD782l
j3N2jEr/vTZVhhxhVfyL
=sT3i
-----END PGP SIGNATURE-----