Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 526
Alerts This Week
Warning Icon 1 526

Ubuntu: 1367-4 Critical: Xulrunner Application Crash Exploit

ubuntu
Calendar Grey February 17, 2012
Scroller Ubuntu
Mitigating the Raptor issue in Fedora releases 25 and 26 to bolster system integrity.
Xulrunner based applications could be made to crash or run programs as your login if they opened a specially crafted file.

Summary

Xulrunner based applications could be made to crash or run programs as your

login if they opened a specially crafted file.

Software Description:

- xulrunner-1.9.2: Mozilla Gecko runtime environment

Details:

USN-1367-1 fixed vulnerabilities in libpng. This provides the corresponding

update for Xulrunner.

Original advisory details:

Jueri Aedla discovered that libpng did not properly verify the size used

when allocating memory during chunk decompression. If a user or automated

system using libpng were tricked into opening a specially crafted image,

an attacker could exploit this to cause a denial of service or execute

code with the privileges of the user invoking the program. (CVE-2011-3026)

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu application crash Xulrunner execution privilege

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.10:
  xulrunner-1.9.2                 1.9.2.27+build1+nobinonly-0ubuntu0.10.10.1

Ubuntu 10.04 LTS:
  xulrunner-1.9.2                 1.9.2.27+build1+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart any application based on
Xulrunner such as Yelp or Conkeror to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1367-4

https://ubuntu.com/security/notices/USN-1367-1

CVE-2011-3026, https://bugs.launchpad.net/ubuntu/+source/xulrunner-1.9.2/+bug/934073

Severity
critical
Lowest
Low
Medium
High
Critical

February 17, 2012

Topics%20covered

Topics Covered

security advisory denial of service critical Ubuntu application crash Xulrunner execution privilege

Package Information

https://launchpad.net/ubuntu/+source/xulrunner-1.9.2/1.9.2.27+build1+nobinonly-0ubuntu0.10.10.1
https://launchpad.net/ubuntu/+source/xulrunner-1.9.2/1.9.2.27+build1+nobinonly-0ubuntu0.10.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.