Ubuntu 16.10: 3124-1 Critical: Firefox Security Issues and Threats

ubuntu

November 19, 2016

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Summary

Firefox could be made to crash or run programs as your login if it

opened a malicious website.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Christian Holler, Andrew McCreight, Dan Minor, Tyson Smith, Jon Coppeard,

Jan-Ivar Bruaroey, Jesse Ruderman, Markus Stange, Olli Pettay, Ehsan

Akhgari, Gary Kwong, Tooru Fujisawa, and Randell Jesup discovered multiple

memory safety issues in Firefox. If a user were tricked in to opening a

specially crafted website, an attacker could potentially exploit these to

cause a denial of service via application crash, or execute arbitrary

code. (CVE-2016-5289, CVE-2016-5290)

A same-origin policy bypass was discovered with local HTML files in some

circumstances. An attacker could potentially exploit this to obtain

sensitive information. (CVE-2016-5291)

A crash was discovered when parsing URLs in some circumstances. If a user

were tricked in to opening a specially crafted website, an attacker could

...

Read the Full Advisory

Topics Covered

security advisory denial of service firefox ubuntu memory safety malicious website

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  firefox                         50.0+build2-0ubuntu0.16.10.2

Ubuntu 16.04 LTS:
  firefox                         50.0+build2-0ubuntu0.16.04.2

Ubuntu 14.04 LTS:
  firefox                         50.0+build2-0ubuntu0.14.04.2

Ubuntu 12.04 LTS:
  firefox                         50.0+build2-0ubuntu0.12.04.2

After a standard system update you need to restart Firefox to make
all the necessary changes.