Ubuntu 12.04 LTS USN-1638-3 Critical: Firefox Application Crash

ubuntu

December 3, 2012

Regressions were introduced in the last Firefox update.

Summary

Regressions were introduced in the last Firefox update.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

USN-1638-1 fixed vulnerabilities in Firefox. The new packages introduced

regressions in cookies handling and the User Agent string. This update fixes

the problem.

Original advisory details:

Gary Kwong, Jesse Ruderman, Christian Holler, Bob Clary, Kyle Huey, Ed

Morley, Chris Lord, Boris Zbarsky, Julian Seward, Bill McCloskey, and

Andrew McCreight discovered multiple memory safety issues affecting

Firefox. If the user were tricked into opening a specially crafted page, an

attacker could possibly exploit these to cause a denial of service via

application crash, or potentially execute code with the privileges of the

user invoking Firefox. (CVE-2012-5842, CVE-2012-5843)

Atte Kettunen discovered a buffer overflow while rendering GIF format

images. An attacker could exploit this to possibly execute arbitrary code

as the ...

Read the Full Advisory

Topics Covered

security advisory buffer overflow cross-site scripting firefox application crash ubuntu regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  firefox                         17.0.1+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  firefox                         17.0.1+build1-0ubuntu0.12.04.1

Ubuntu 11.10:
  firefox                         17.0.1+build1-0ubuntu0.11.10.1

Ubuntu 10.04 LTS:
  firefox                         17.0.1+build1-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox to make all
the necessary changes.