Ubuntu 14.04 LTS USN-2265-1 Critical NSPR Denial Of Service

ubuntu

July 2, 2014

NSPR could be made to crash or run programs if it received specially crafted input.

Summary

NSPR could be made to crash or run programs if it received specially

crafted input.

Software Description:

- nspr: NetScape Portable Runtime Library

Details:

Abhishek Arya discovered that NSPR incorrectly handled certain console

functions. A remote attacker could use this issue to cause NSPR to crash,

resulting in a denial of service, or possibly execute arbitrary code. The

default compiler options for affected releases should reduce the

vulnerability to a denial of service.

Topics Covered

security advisory denial of service software update remote code execution ubuntu nspr

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libnspr4                        2:4.10.2-1ubuntu1.1

Ubuntu 13.10:
  libnspr4                        2:4.9.5-1ubuntu1.2

Ubuntu 12.04 LTS:
  libnspr4                        4.9.5-0ubuntu0.12.04.3

Ubuntu 10.04 LTS:
  libnspr4-0d                     4.9.5-0ubuntu0.10.04.3

After a standard system update you need to restart your session to make all
the necessary changes.