Ubuntu 2550-1 Moderate: Firefox Crash And Remote Attack Risks

ubuntu

April 1, 2015

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Olli Pettay and Boris Zbarsky discovered an issue during anchor

navigations in some circumstances. If a user were tricked in to opening

a specially crafted website, an attacker could potentially exploit this

to bypass same-origin policy restrictions. (CVE-2015-0801)

Bobby Holley discovered that windows created to hold privileged UI content

retained access to privileged internal methods if navigated to

unprivileged content. An attacker could potentially exploit this in

combination with another flaw, in order to execute arbitrary script in a

privileged context. (CVE-2015-0802)

Several type confusion issues were discovered in Firefox. If a user were

tricked in to opening a specially crafted website, an attacker could

potentially exploit these to cause a denial of service via application

cras...

Read the Full Advisory

Topics Covered

security advisory remote attack Ubuntu application crash web browser Firefox

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  firefox                         37.0+build2-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  firefox                         37.0+build2-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  firefox                         37.0+build2-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.