Ubuntu 12.04 LTS USN-1729-1 Critical: Firefox Denial of Service Issues

ubuntu

February 20, 2013

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it opened a

malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Olli Pettay, Christoph Diehl, Gary Kwong, Jesse Ruderman, Andrew McCreight,

Joe Drew, Wayne Mery, Alon Zakai, Christian Holler, Gary Kwong, Luke

Wagner, Terrence Cole, Timothy Nikkel, Bill McCloskey, and Nicolas Pierron

discovered multiple memory safety issues affecting Firefox. If the user

were tricked into opening a specially crafted page, an attacker could

possibly exploit these to cause a denial of service via application crash.

(CVE-2013-0783, CVE-2013-0784)

Atte Kettunen discovered that Firefox could perform an out-of-bounds read

while rendering GIF format images. An attacker could exploit this to crash

Firefox. (CVE-2013-0772)

Boris Zbarsky discovered that Firefox did not properly handle some wrapped

WebIDL objects. If the user were tricked into opening a specially crafted

page, an...

Read the Full Advisory

Topics Covered

security advisory denial of service critical remote code execution Ubuntu Firefox

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  firefox                         19.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  firefox                         19.0+build1-0ubuntu0.12.04.1

Ubuntu 11.10:
  firefox                         19.0+build1-0ubuntu0.11.10.1

Ubuntu 10.04 LTS:
  firefox                         19.0+build1-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox to make all the
necessary changes.