Ubuntu: USN-2102-1 High: Firefox Memory Issues and Code Execution Threat

ubuntu

February 10, 2014

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Christian Holler, Terrence Cole, Jesse Ruderman, Gary Kwong, Eric

Rescorla, Jonathan Kew, Dan Gohman, Ryan VanderMeulen, Carsten Book,

Andrew Sutherland, Byron Campen, Nicholas Nethercote, Paul Adenot, David

Baron, Julian Seward and Sotaro Ikeda discovered multiple memory safety

issues in Firefox. If a user were tricked in to opening a specially

crafted website, an attacker could potentially exploit these to cause a

denial of service via application crash, or execute arbitrary code with

the privileges of the user invoking Firefox. (CVE-2014-1477,

CVE-2014-1478)

Cody Crews discovered a method to bypass System Only Wrappers. An attacker

could potentially exploit this to steal confidential data or execute code

with the privileges of the user invoking Firefox. (CVE-2014-1479)

Jordi Chancel di...

Read the Full Advisory

Topics Covered

security advisory code execution Ubuntu firefox application crash memory safety clickjacking

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  firefox                         27.0+build1-0ubuntu0.13.10.1

Ubuntu 12.10:
  firefox                         27.0+build1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  firefox                         27.0+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.