Ubuntu 16.04 LTS: USN-2936-3 Critical: Firefox Regression Issue

ubuntu

May 19, 2016

USN-2936-1 introduced a regression in Firefox.

Summary

USN-2936-1 introduced a regression in Firefox.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

USN-2936-1 fixed vulnerabilities in Firefox. The update caused an issue

where a device update POST request was sent every time about:preferences#sync

was shown. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman,

Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup,

Andrew McCreight, and Steve Fink discovered multiple memory safety issues

in Firefox. If a user were tricked in to opening a specially crafted

website, an attacker could potentially exploit these to cause a denial of

service via application crash, or execute arbitrary code with the

privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806,

CVE-2016-2807)

An invalid write was discovered when using the JavaScript .wa...

Read the Full Advisory

Topics Covered

security advisory critical firefox ubuntu regression web exploit

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  firefox                         46.0.1+build1-0ubuntu0.16.04.2

Ubuntu 15.10:
  firefox                         46.0.1+build1-0ubuntu0.15.10.2

Ubuntu 14.04 LTS:
  firefox                         46.0.1+build1-0ubuntu0.14.04.3

Ubuntu 12.04 LTS:
  firefox                         46.0.1+build1-0ubuntu0.12.04.2

After a standard system update you need to restart Firefox to make
all the necessary changes.