Ubuntu 12.04 LTS: USN-1463-1 Critical: Firefox Memory Safety Issues

ubuntu

June 6, 2012

Several security issues were fixed in Firefox.

Summary

Several security issues were fixed in Firefox.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Jesse Ruderman, Igor Bukanov, Bill McCloskey, Christian Holler, Andrew

McCreight, Olli Pettay, Boris Zbarsky, and Brian Bondy discovered memory

safety issues affecting Firefox. If the user were tricked into opening a

specially crafted page, an attacker could possibly exploit these to cause a

denial of service via application crash, or potentially execute code with

the privileges of the user invoking Firefox. (CVE-2012-1937, CVE-2012-1938)

It was discovered that Mozilla's WebGL implementation exposed a bug in

certain NVIDIA graphics drivers. The impact of this issue has not been

disclosed at this time. (CVE-2011-3101)

Adam Barth discovered that certain inline event handlers were not being

blocked properly by the Content Security Policy's (CSP) inline-script

blocking feature. Web applications relying on this feature of CSP to

protect agai...

Read the Full Advisory

Topics Covered

security advisory denial of service critical firefox web security ubuntu memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  firefox                         13.0+build1-0ubuntu0.12.04.1

Ubuntu 11.10:
  firefox                         13.0+build1-0ubuntu0.11.10.1

Ubuntu 11.04:
  firefox                         13.0+build1-0ubuntu0.11.04.1

Ubuntu 10.04 LTS:
  firefox                         13.0+build1-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.