Ubuntu 14.04 LTS: USN-2185-1 Critical: Firefox Denial Of Service Alert

ubuntu

April 29, 2014

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij,

Jesse Ruderman, Nathan Froyd, John Schoenick, Karl Tomlinson, Vladimir

Vukicevic and Christian Holler discovered multiple memory safety issues in

Firefox. If a user were tricked in to opening a specially crafted website,

an attacker could potentially exploit these to cause a denial of service

via application crash, or execute arbitrary code with the privileges of

the user invoking Firefox. (CVE-2014-1518, CVE-2014-1519)

An out of bounds read was discovered in Web Audio. An attacker could

potentially exploit this cause a denial of service via application crash

or execute arbitrary code with the privileges of the user invoking

Firefox. (CVE-2014-1522)

Abhishek Arya discovered an out of bounds read when decoding JPG images.

...

Read the Full Advisory

Topics Covered

security advisory denial of service critical Ubuntu firefox malicious code memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  firefox                         29.0+build1-0ubuntu0.14.04.2

Ubuntu 13.10:
  firefox                         29.0+build1-0ubuntu0.13.10.3

Ubuntu 12.10:
  firefox                         29.0+build1-0ubuntu0.12.10.3

Ubuntu 12.04 LTS:
  firefox                         29.0+build1-0ubuntu0.12.04.2

After a standard system update you need to restart Firefox to make
all the necessary changes.