Ubuntu 14.10 USN-2458-2 Critical: Firefox Memory Safety Risks

ubuntu

January 14, 2015

This update provides compatible packages for Firefox 35.

Summary

This update provides compatible packages for Firefox 35.

Software Description:

- ubufox: Ubuntu Firefox specific configuration defaults and apt support

Details:

USN-2458-1 fixed vulnerabilities in Firefox. This update provides the

corresponding version of Ubufox.

Original advisory details:

Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse

Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered

multiple memory safety issues in Firefox. If a user were tricked in to

opening a specially crafted website, an attacker could potentially exploit

these to cause a denial of service via application crash, or execute

arbitrary code with the privileges of the user invoking Firefox.

(CVE-2014-8634, CVE-2014-8635)

Bobby Holley discovered that some DOM objects with certain properties

can bypass XrayWrappers in some circumstances. If a user were tricked in

to opening a specially crafted website, an attacker could potentially

e...

Read the Full Advisory

Topics Covered

security advisory software patch DoS application security Ubuntu memory safety Firefox update

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  xul-ext-ubufox                  3.0-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  xul-ext-ubufox                  3.0-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  xul-ext-ubufox                  3.0-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.