bugtraq - [SECURITY] [DSA 3345-1] iceweasel security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1ZVY1F-0002Qw-Rt@master.debian.org>
Date: Sat, 29 Aug 2015 04:45:33 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3345-1] iceweasel security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3345-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
August 29, 2015                       https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : iceweasel
CVE ID         : CVE-2015-4497 CVE-2015-4498

Multiple security issues have been found in Iceweasel, Debian's version
of the Mozilla Firefox web browser. The Common Vulnerabilities and
Exposures project identifies the following problems:

CVE-2015-4497

    Jean-Max Reymond and Ucha Gobejishvili discovered a use-after-free
    vulnerability which occurs when resizing of a canvas element is
    triggered in concert with style changes. A web page containing
    malicious content can cause Iceweasel to crash, or potentially,
    execute arbitrary code with the privileges of the user running
    Iceweasel.

CVE-2015-4498

    Bas Venis reported a flaw in the handling of add-ons installation. A
    remote attacker can take advantage of this flaw to bypass the add-on
    installation prompt and trick a user into installing an add-on from
    a malicious source.

For the oldstable distribution (wheezy), these problems have been fixed
in version 38.2.1esr-1~deb7u1.

For the stable distribution (jessie), these problems have been fixed in
version 38.2.1esr-1~deb8u1.

For the unstable distribution (sid), these problems have been fixed in
version 38.2.1esr-1.

We recommend that you upgrade your iceweasel packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJV4Ti2AAoJEAVMuPMTQ89EuxQP/3bWxIX2aDy1urpbNZhrIvSC
8QvGSKIhtz9XcCO53oMcah+XTjZEthjKc4wd+wNGEybw9fR6YojFbf/RjLetUMMF
1sDYvt34jRzcz2tLnGqYfY/hLkbxr5L52kcYn1YVZZJ3ol+XFGqm2sf/OTRpiQgl
mvh7NtNjpBGhkL3x85B+wlKvKd0Nz+p83XgQ6qq+PQcm4iusrCyjnc0DwXCngc+1
kSNho0+/aOUnCxpX1QOmyRGqcxUWDmj88YIpg7xBjfcKhTslFiTpYC3yF2dz73+X
MyySK1I7nu9U5alH/eoOd4SaYVdpkufR/MhhCWOxDzTjRtiP+tGAc3/a5/7i6/Kl
B8wPDhgkui2DHLaxz4dsjsuJ1YPfBMDa68+ilCYuNWjTnIid/Yho1vr5a0fQFNqF
vTUaLVH9xnqTUM/SShp79Sta4n7f+NM8DrIJKQQH03D3XwA9NcJWPUoUm6nftdp9
qcvO3du4Zqn8vwxSVb+xNQlQgrrvJ37nvJtVXavSqfAZWKVYeMpNjyqlOcMKvhR0
tbT0x4YhtHs6c1q+BoldnjISe2wHNNWwQNRW8SrM5K+nzReQLjbm28uSWFVWf3Lq
567zgxCsbjlI2oXh3tftG9BY3ylh4mEna1cRhnnrnQU2Nl873sL3YOyuHyheAdTp
g71rt6+1YTi8VmDxycAZ
=tzb9
-----END PGP SIGNATURE-----