Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Ubuntu 11.10 USN-1277-1 Critical: Firefox Data Risks and Fixes

ubuntu
Calendar Grey November 23, 2011
Scroller Ubuntu
A series of security flaws in Firefox have been addressed to safeguard against information leakage and service disruption problems for users of Ubuntu.
Multiple vulnerabilities have been fixed in Firefox.

Summary

Multiple vulnerabilities have been fixed in Firefox.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Yosuke Hasegawa discovered that the Mozilla browser engine mishandled

invalid sequences in the Shift-JIS encoding. It may be possible to trigger

this crash without the use of debugging APIs, which might allow malicious

websites to exploit this vulnerability. An attacker could possibly use this

flaw this to steal data or inject malicious scripts into web content.

(CVE-2011-3648)

Marc Schoenefeld discovered that using Firebug to profile a JavaScript file

with many functions would cause Firefox to crash. An attacker might be able

to exploit this without using the debugging APIs, which could potentially

remotely crash the browser, resulting in a denial of service.

(CVE-2011-3650)

Jason Orendorff, Boris Zbarsky, Gregg Tavares, Mats Palmgren, Christian

Holler, Jesse Ruderman, Simona Marcu, Bob Clary, and William McCloskey

discovered mu...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical firefox ubuntu browser exploit data risk

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  firefox                         8.0+build1-0ubuntu0.11.10.3

Ubuntu 11.04:
  firefox                         8.0+build1-0ubuntu0.11.04.3

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1277-1

CVE-2011-3648, CVE-2011-3650, CVE-2011-3651, CVE-2011-3652,

CVE-2011-3654, CVE-2011-3655, https://bugs.launchpad.net/ubuntu/+source/firefox/+bug/887339

Severity
critical
Lowest
Low
Medium
High
Critical

November 23, 2011

Topics%20covered

Topics Covered

security advisory denial of service critical firefox ubuntu browser exploit data risk

Package Information

https://launchpad.net/ubuntu/+source/firefox/8.0+build1-0ubuntu0.11.10.3
https://launchpad.net/ubuntu/+source/firefox/8.0+build1-0ubuntu0.11.04.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.