Ubuntu 14.10 USN-2458-3 Critical: Firefox Regression Fix Details

ubuntu

January 27, 2015

USN-2458-1 introduced a regression in Firefox

Summary

USN-2458-1 introduced a regression in Firefox

Software Description:

- firefox: Mozilla Open Source web browser

Details:

USN-2458-1 fixed vulnerabilities in Firefox. This update introduced a

regression which could make websites that use CSP fail to load under some

circumstances. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse

Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered

multiple memory safety issues in Firefox. If a user were tricked in to

opening a specially crafted website, an attacker could potentially exploit

these to cause a denial of service via application crash, or execute

arbitrary code with the privileges of the user invoking Firefox.

(CVE-2014-8634, CVE-2014-8635)

Bobby Holley discovered that some DOM objects with certain properties

can bypass XrayWrappers in some circumstances. If a user were ...

Read the Full Advisory

Topics Covered

security advisory denial of service critical firefox ubuntu regression web issues

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  firefox                         35.0.1+build1-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  firefox                         35.0.1+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  firefox                         35.0.1+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.