Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -6 articles for you...
202
security advisorysoftware updatepatchopenSUSE 12.3: 2013:1633-1 Important: Mozilla Suite Memory Safety
An update that fixes 23 vulnerabilities is now available. An update that fixes 23 vulnerabilities is now available. An update that fixes 23 vulnerabilities is now available.. openSUSE Security Update: Mozilla Suite: Update to October 2013 release ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1633-1 Rating: important References: #840485 #847708 Cross-References: CVE-2013-1705 CVE-2013-1718 CVE-2013-1722 CVE-2013-1725 CVE-2013-1730 CVE-2013-1732 CVE-2013-1735 CVE-2013-1736 CVE-2013-1737 CVE-2013-5590 CVE-2013-5591 CVE-2013-5592 CVE-2013-5593 CVE-2013-5595 CVE-2013-5596 CVE-2013-5597 CVE-2013-5598 CVE-2013-5599 CVE-2013-5600 CVE-2013-5601 CVE-2013-5602 CVE-2013-5603 CVE-2013-5604 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes 23 vulnerabilities is now available. Description: MozillaFirefox was updated to Firefox 25.0. MozillaThunderbird was updated to Thunderbird 24.1.0. Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR was updated to 4.10.1. Changes in MozillaFirefox: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird: * requires NSS 3.15.2 or above * MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers * MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 * fqdn for smtp server name was not accepted (bmo#913785) * fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 * The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. * New dialog to change the expiry date of keys * New function to search for the OpenPGP keys of all Address Book entries on a keyserver * removed obsolete enigmail-build.patch Changes in xulrunner: - update to 17.0.10esr (bnc#847708) * require NSS 3.14.4 or above * MFSA2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards * MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data * MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions * MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache * MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing * MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - update to 17.0.9esr (bnc#840485) * MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests * MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards * MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning * MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new Javascript objects can lead to memory corruption * MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes * MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats * MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling * MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong "this" object Changes in mozilla-nspr: - update to version 4.10.1 * bmo#888273: RWIN Scaling (RFC1323) limited to 2 on Windows 7 and 8 (Windows only) * bmo#907512: Unix platforms shouldn't mask errors specific to Unix domain sockets Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-819 - openSUSE 12.2: zypper in -t patch openSUSE-2013-819 To bringyour system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): MozillaFirefox-25.0-1.39.1 MozillaFirefox-branding-upstream-25.0-1.39.1 MozillaFirefox-buildsymbols-25.0-1.39.1 MozillaFirefox-debuginfo-25.0-1.39.1 MozillaFirefox-debugsource-25.0-1.39.1 MozillaFirefox-devel-25.0-1.39.1 MozillaFirefox-translations-common-25.0-1.39.1 MozillaFirefox-translations-other-25.0-1.39.1 MozillaThunderbird-24.1.0-61.31.1 MozillaThunderbird-buildsymbols-24.1.0-61.31.1 MozillaThunderbird-debuginfo-24.1.0-61.31.1 MozillaThunderbird-debugsource-24.1.0-61.31.1 MozillaThunderbird-devel-24.1.0-61.31.1 MozillaThunderbird-translations-common-24.1.0-61.31.1 MozillaThunderbird-translations-other-24.1.0-61.31.1 enigmail-1.6.0+24.1.0-61.31.1 enigmail-debuginfo-1.6.0+24.1.0-61.31.1 mozilla-js-17.0.10-1.30.2 mozilla-js-debuginfo-17.0.10-1.30.2 mozilla-nspr-4.10.1-1.18.1 mozilla-nspr-debuginfo-4.10.1-1.18.1 mozilla-nspr-debugsource-4.10.1-1.18.1 mozilla-nspr-devel-4.10.1-1.18.1 xulrunner-17.0.10-1.30.2 xulrunner-buildsymbols-17.0.10-1.30.2 xulrunner-debuginfo-17.0.10-1.30.2 xulrunner-debugsource-17.0.10-1.30.2 xulrunner-devel-17.0.10-1.30.2 xulrunner-devel-debuginfo-17.0.10-1.30.2 - openSUSE 12.3 (x86_64): mozilla-js-32bit-17.0.10-1.30.2 mozilla-js-debuginfo-32bit-17.0.10-1.30.2 mozilla-nspr-32bit-4.10.1-1.18.1 mozilla-nspr-debuginfo-32bit-4.10.1-1.18.1 xulrunner-32bit-17.0.10-1.30.2 xulrunner-debuginfo-32bit-17.0.10-1.30.2 - openSUSE 12.2 (i586 x86_64): MozillaFirefox-25.0-2.63.1 MozillaFirefox-branding-upstream-25.0-2.63.1 MozillaFirefox-buildsymbols-25.0-2.63.1 MozillaFirefox-debuginfo-25.0-2.63.1 MozillaFirefox-debugsource-25.0-2.63.1 MozillaFirefox-devel-25.0-2.63.1 MozillaFirefox-translations-common-25.0-2.63.1 MozillaFirefox-translations-other-25.0-2.63.1 MozillaThunderbird-24.1.0-49.59.2 MozillaThunderbird-buildsymbols-24.1.0-49.59.2 MozillaThunderbird-debuginfo-24.1.0-49.59.2 MozillaThunderbird-debugsource-24.1.0-49.59.2 MozillaThunderbird-devel-24.1.0-49.59.2 MozillaThunderbird-translations-common-24.1.0-49.59.2 MozillaThunderbird-translations-other-24.1.0-49.59.2 enigmail-1.6.0+24.1.0-49.59.2 mozilla-js-17.0.10-2.56.2 mozilla-js-debuginfo-17.0.10-2.56.2 mozilla-nspr-4.10.1-1.20.1 mozilla-nspr-debuginfo-4.10.1-1.20.1 mozilla-nspr-debugsource-4.10.1-1.20.1 mozilla-nspr-devel-4.10.1-1.20.1 xulrunner-17.0.10-2.56.2 xulrunner-buildsymbols-17.0.10-2.56.2 xulrunner-debuginfo-17.0.10-2.56.2 xulrunner-debugsource-17.0.10-2.56.2 xulrunner-devel-17.0.10-2.56.2 xulrunner-devel-debuginfo-17.0.10-2.56.2 - openSUSE 12.2 (x86_64): mozilla-js-32bit-17.0.10-2.56.2 mozilla-js-debuginfo-32bit-17.0.10-2.56.2 mozilla-nspr-32bit-4.10.1-1.20.1 mozilla-nspr-debuginfo-32bit-4.10.1-1.20.1 xulrunner-32bit-17.0.10-2.56.2 xulrunner-debuginfo-32bit-17.0.10-2.56.2 References: https://www.suse.com/security/cve/CVE-2013-1705.html https://www.suse.com/security/cve/CVE-2013-1718.html https://www.suse.com/security/cve/CVE-2013-1722.html https://www.suse.com/security/cve/CVE-2013-1725.html https://www.suse.com/security/cve/CVE-2013-1730.html https://www.suse.com/security/cve/CVE-2013-1732.html https://www.suse.com/security/cve/CVE-2013-1735.html https://www.suse.com/security/cve/CVE-2013-1736.html https://www.suse.com/security/cve/CVE-2013-1737.html https://www.suse.com/security/cve/CVE-2013-5590.html https://www.suse.com/security/cve/CVE-2013-5591.html https://www.suse.com/security/cve/CVE-2013-5592.html https://www.suse.com/security/cve/CVE-2013-5593.html https://www.suse.com/security/cve/CVE-2013-5595.html https://www.suse.com/security/cve/CVE-2013-5596.html https://www.suse.com/security/cve/CVE-2013-5597.html https://www.suse.com/security/cve/CVE-2013-5598.html https://www.suse.com/security/cve/CVE-2013-5599.html https://www.suse.com/security/cve/CVE-2013-5600.html https://www.suse.com/security/cve/CVE-2013-5601.html https://www.suse.com/security/cve/CVE-2013-5602.html https://www.suse.com/security/cve/CVE-2013-5603.html https://www.suse.com/security/cve/CVE-2013-5604.html . Enhance configurations in Firefox for Fedora by resolving 23 vulnerabilities, focusing on optimization of performance and ensuring enhanced security protocols.. Mozilla Suite, openSUSE Security, Software Fixes. . Severity: Important. LinuxSecurity.com Team
Nov 07, 2013
•Important
OpenSUSE
91
security advisoryinformation leakgentooGentoo: GLSA-200604-19 Moderate: Firefox Multiple Vulnerability Risk
Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200604-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mozilla Suite: Multiple vulnerabilities Date: April 28, 2006 Bugs: #130887 ID: 200604-18 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Several vulnerabilities in Mozilla Suite allow attacks ranging from script execution with elevated privileges to information leaks. Background ========= The Mozilla Suite is a popular all-in-one web browser that includes a mail and news reader. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/mozilla < 1.7.13 > = 1.7.13 2 www-client/mozilla-bin < 1.7.13 > = 1.7.13 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Several vulnerabilities were found in Mozilla Suite. Version 1.7.13 was released to fix them. Impact ===== A remote attacker could craft malicious web pages or emails that would leverage these issues to inject and execute arbitrary script code with elevated privileges, steal local files, cookies or other information from web pages or emails, and spoof content. Some of these vulnerabilities might even be exploited to execute arbitrary codewith the rights of the user running the client. Workaround ========= There are no known workarounds for all the issues at this time. Resolution ========= All Mozilla Suite users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/mozilla-1.7.13" All Mozilla Suite binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/mozilla-bin-1.7.13" References ========= [ 1 ] CVE-2005-4134 https://www.cve.org/CVERecord?id=CVE-2005-4134 [ 2 ] CVE-2006-0292 https://www.cve.org/CVERecord?id=CVE-2006-0292 [ 3 ] CVE-2006-0293 https://www.cve.org/CVERecord?id=CVE-2006-0293 [ 4 ] CVE-2006-0296 https://www.cve.org/CVERecord?id=CVE-2006-0296 [ 5 ] CVE-2006-0748 https://www.cve.org/CVERecord?id=CVE-2006-0748 [ 6 ] CVE-2006-0749 https://www.cve.org/CVERecord?id=CVE-2006-0749 [ 7 ] CVE-2006-0884 https://www.cve.org/CVERecord?id=CVE-2006-0884 [ 8 ] CVE-2006-1045 https://www.cve.org/CVERecord?id=CVE-2006-1045 [ 9 ] CVE-2006-1727 https://www.cve.org/CVERecord?id=CVE-2006-1727 [ 10 ] CVE-2006-1728 https://www.cve.org/CVERecord?id=CVE-2006-1728 [ 11 ] CVE-2006-1729 https://www.cve.org/CVERecord?id=CVE-2006-1729 [ 12 ] CVE-2006-1730 https://www.cve.org/CVERecord?id=CVE-2006-1730 [ 13 ] CVE-2006-1731 https://www.cve.org/CVERecord?id=CVE-2006-1731 [ 14 ] CVE-2006-1732 https://www.cve.org/CVERecord?id=CVE-2006-1732 [ 15 ] CVE-2006-1733 https://www.cve.org/CVERecord?id=CVE-2006-1733 [ 16 ] CVE-2006-1734 https://www.cve.org/CVERecord?id=CVE-2006-1734 [ 17 ] CVE-2006-1735 https://www.cve.org/CVERecord?id=CVE-2006-1735 [ 18 ] CVE-2006-1736 https://www.cve.org/CVERecord?id=CVE-2006-1736 [ 19 ] CVE-2006-1737 https://www.cve.org/CVERecord?id=CVE-2006-1737 [ 20 ] CVE-2006-1738 https://www.cve.org/CVERecord?id=CVE-2006-1738 [ 21 ] CVE-2006-1739 https://www.cve.org/CVERecord?id=CVE-2006-1739 [ 22 ] CVE-2006-1740 https://www.cve.org/CVERecord?id=CVE-2006-1740 [ 23 ] CVE-2006-1741 https://www.cve.org/CVERecord?id=CVE-2006-1741 [ 24 ] CVE-2006-1742 https://www.cve.org/CVERecord?id=CVE-2006-1742 [ 25 ] CVE-2006-1790 https://www.cve.org/CVERecord?id=CVE-2006-1790 [ 26 ] Mozilla Foundation Security Advisories https://www.mozilla.org/en-US/security/known-vulnerabilities/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200604-18 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Apr 28, 2006
Gentoo
91
security advisorygentoocode executionGentoo: GLSA 202311-15 Important: Mozilla Firefox Several Vulnerabilities
This advisory was originally released to fix the heap overflow in IDN headers. However, the official fixed release included several other security fixes as well. [More...] [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory [UPDATE] GLSA 200509-11:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mozilla Suite, Mozilla Firefox: Multiple vulnerabilities Date: September 18, 2005 Updated: September 29, 2005 Bugs: #105396 ID: 200509-11:02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Update ===== This advisory was originally released to fix the heap overflow in IDN headers. However, the official fixed release included several other security fixes as well. The updated sections appear below. Synopsis ======= Mozilla Suite and Firefox are vulnerable to multiple issues, including some that might be exploited to execute arbitrary code. Background ========= The Mozilla Suite is a popular all-in-one web browser that includes a mail and news reader. Mozilla Firefox is the next-generation browser from the Mozilla project. Gecko is the layout engine used in both products. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-client/mozilla-firefox < 1.0.7-r2 > = 1.0.7-r2 2 www-client/mozilla < 1.7.12-r2 > = 1.7.12-r2 3 www-client/mozilla-firefox-bin < 1.0.7 > = 1.0.7 4 www-client/mozilla-bin < 1.7.12 > = 1.7.12 5 net-libs/gecko-sdk < 1.7.12 > = 1.7.12 ------------------------------------------------------------------- 5 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== The Mozilla Suite and Firefox are both vulnerable to the following issues: * Tom Ferris reported a heap overflow in IDN-enabled browsers with malicious Host: headers (CAN-2005-2871). * "jackerror" discovered a heap overrun in XBM image processing (CAN-2005-2701). * Mats Palmgren reported a potentially exploitable stack corruption using specific Unicode sequences (CAN-2005-2702). * Georgi Guninski discovered an integer overflow in the JavaScript engine (CAN-2005-2705) * Other issues ranging from DOM object spoofing to request header spoofing were also found and fixed in the latest versions (CAN-2005-2703, CAN-2005-2704, CAN-2005-2706, CAN-2005-2707). The Gecko engine in itself is also affected by some of these issues and has been updated as well. Impact ===== A remote attacker could setup a malicious site and entice a victim to visit it, potentially resulting in arbitrary code execution with the victim's privileges or facilitated spoofing of known websites. Workaround ========= There is no known workaround for all the issues. Resolution ========= All Mozilla Firefox users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/mozilla-firefox-1.0.7-r2" All Mozilla Suite users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/mozilla-1.7.12-r2" All Mozilla Firefox binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/mozilla-firefox-bin-1.0.7" All Mozilla Suite binary users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-client/mozilla-bin-1.7.12" All Gecko library users should upgrade to the latest version: #emerge --sync # emerge --ask --oneshot --verbose "> =net-libs/gecko-sdk-1.7.12" References ========= [ 1 ] CAN-2005-2701 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2701 [ 2 ] CAN-2005-2702 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2702 [ 3 ] CAN-2005-2703 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2703 [ 4 ] CAN-2005-2704 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2704 [ 5 ] CAN-2005-2705 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2705 [ 6 ] CAN-2005-2706 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2706 [ 7 ] CAN-2005-2707 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2707 [ 8 ] CAN-2005-2871 https://www.cve.org/CVERecord?id=CVE-CAN-2005-2871 [ 9 ] Mozilla Foundation Security Advisories https://www.mozilla.org/en-US/security/known-vulnerabilities/ Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200509-11 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 30, 2005
•Important
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!