Ubuntu 15.10 USN-2880-1 High: Firefox Exploits Lead To Security Risks

ubuntu

January 27, 2016

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Bob Clary, Christian Holler, Nils Ohlmeier, Gary Kwong, Jesse Ruderman,

Carsten Book, Randell Jesup, Nicolas Pierron, Eric Rescorla, Tyson Smith,

and Gabor Krizsanits discovered multiple memory safety issues in Firefox.

If a user were tricked in to opening a specially crafted website, an

attacker could potentially exploit these to cause a denial of service via

application crash, or execute arbitrary code with the privileges of the

user invoking Firefox. (CVE-2016-1930, CVE-2016-1931)

Gustavo Grieco discovered an out-of-memory crash when loading GIF images

in some circumstances. If a user were tricked in to opening a specially

crafted website, an attacker could exploit this to cause a denial of

service. (CVE-2016-1933)

Aki Helin discovered a buffer overflow when rendering WebGL content in

...

Read the Full Advisory

Topics Covered

security advisory denial of service exploit Ubuntu Firefox memory safety

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  firefox                         44.0+build3-0ubuntu0.15.10.1

Ubuntu 15.04:
  firefox                         44.0+build3-0ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  firefox                         44.0+build3-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  firefox                         44.0+build3-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.