Wiki » Support/Advisories/MGASA-2013-0020

MGASA-2013-0020

Date:	January 26th, 2013
Affected releases:	2

Description:
Updated firefox packages fix security vulnerabilities:

Google reported to Mozilla that TURKTRUST, a certificate authority in
Mozillas root program, had mis-issued two intermediate certificates
to customers. The issue was not specific to Firefox but there was
evidence that one of the certificates was used for man-in-the-middle
(MITM) traffic management of domain names that the customer did not
legitimately own or control. This issue was resolved by revoking the
trust for these specific mis-issued certificates (CVE-2013-0743).

Security researcher regenrecht reported, via TippingPoint's Zero Day
Initiative, a use-after-free within the ListenerManager when garbage
collection is forced after data in listener objects have been allocated
in some circumstances. This results in a use-after-free which can
lead to arbitrary code execution (CVE-2013-0754).

Security researcher regenrecht reported, via TippingPoint's Zero
Day Initiative, a use-after-free in XMLSerializer by the exposing
of serializeToStream to web content. This can lead to arbitrary code
execution when exploited (CVE-2013-0753).

Security researcher Mariusz Mlynski reported that it is possible
to open a chrome privileged web page through plugin objects through
interaction with SVG elements. This could allow for arbitrary code
execution (CVE-2013-0758).

Security researcher pa_kt reported a flaw via TippingPoint's Zero Day
Initiative that an integer overflow is possible when calculating the
length for a Javascript string concatenation, which is then used for
memory allocation. This results in a buffer overflow, leading to a
potentially exploitable memory corruption (CVE-2013-0750).

Mozilla security researcher Jesse Ruderman discovered that using the
toString function of XBL objects can lead to inappropriate information
leakage by revealing the address space layout instead of just the ID
of the object. This layout information could potentially be used to
bypass ASLR and other security protections (CVE-2013-0748).

Mozilla developer Boris Zbarsky reported reported a problem where
jsval-returning quickstubs fail to wrap their return values, causing
a compartment mismatch. This mismatch can cause garbage collection
to occur incorrectly and lead to a potentially exploitable crash
(CVE-2013-0746).

Using the Address Sanitizer tool, security researcher Atte Kettunen
from OUSPG discovered that the combination of large numbers
of columns and column groups in a table could cause the array
containing the columns during rendering to overwrite itself. This
can lead to a user-after-free causing a potentially exploitable crash
(CVE-2013-0744).

Security researcher Abhishek Arya (Inferno) of the Google Chrome
Security Team discovered a series critically rated of use-after-free,
out of bounds read, and buffer overflow issues using the Address
Sanitizer tool in shipped software. These issues are potentially
exploitable, allowing for remote code execution. We would also like
to thank Abhishek for reporting three additional user-after-free and
out of bounds read flaws introduced during Firefox development that
were fixed before general release (CVE-2013-0762, CVE-2013-0766,
CVE-2013-0767).

Mozilla developers identified and fixed several memory safety
bugs in the browser engine used in Firefox and other Mozilla-based
products. Some of these bugs showed evidence of memory corruption under
certain circumstances, and we presume that with enough effort at least
some of these could be exploited to run arbitrary code (CVE-2013-0769).

Security researcher Masato Kinugawa found a flaw in which the
displayed URL values within the addressbar can be spoofed by a page
during loading. This allows for phishing attacks where a malicious
page can spoof the identify of another site (CVE-2013-0759).

Firefox has been updated to version 17.0.2, which fixes these issues,
as well as provides several new features.

Additionally, the DuckDuckGo search engine has been added as an option
in the search bar.

Updated Packages:
i586:
firefox-17.0.2-3.mga2.i586.rpm
firefox-devel-17.0.2-3.mga2.i586.rpm
firefox-af-17.0.2-1.mga2.noarch.rpm
firefox-ar-17.0.2-1.mga2.noarch.rpm
firefox-ast-17.0.2-1.mga2.noarch.rpm
firefox-be-17.0.2-1.mga2.noarch.rpm
firefox-bg-17.0.2-1.mga2.noarch.rpm
firefox-bn_BD-17.0.2-1.mga2.noarch.rpm
firefox-bn_IN-17.0.2-1.mga2.noarch.rpm
firefox-br-17.0.2-1.mga2.noarch.rpm
firefox-bs-17.0.2-1.mga2.noarch.rpm
firefox-ca-17.0.2-1.mga2.noarch.rpm
firefox-cs-17.0.2-1.mga2.noarch.rpm
firefox-cy-17.0.2-1.mga2.noarch.rpm
firefox-da-17.0.2-1.mga2.noarch.rpm
firefox-de-17.0.2-1.mga2.noarch.rpm
firefox-el-17.0.2-1.mga2.noarch.rpm
firefox-en_GB-17.0.2-1.mga2.noarch.rpm
firefox-en_ZA-17.0.2-1.mga2.noarch.rpm
firefox-eo-17.0.2-1.mga2.noarch.rpm
firefox-es_AR-17.0.2-1.mga2.noarch.rpm
firefox-es_CL-17.0.2-1.mga2.noarch.rpm
firefox-es_ES-17.0.2-1.mga2.noarch.rpm
firefox-es_MX-17.0.2-1.mga2.noarch.rpm
firefox-et-17.0.2-1.mga2.noarch.rpm
firefox-eu-17.0.2-1.mga2.noarch.rpm
firefox-fa-17.0.2-1.mga2.noarch.rpm
firefox-fi-17.0.2-1.mga2.noarch.rpm
firefox-fr-17.0.2-1.mga2.noarch.rpm
firefox-fy-17.0.2-1.mga2.noarch.rpm
firefox-ga_IE-17.0.2-1.mga2.noarch.rpm
firefox-gd-17.0.2-1.mga2.noarch.rpm
firefox-gl-17.0.2-1.mga2.noarch.rpm
firefox-gu_IN-17.0.2-1.mga2.noarch.rpm
firefox-he-17.0.2-1.mga2.noarch.rpm
firefox-hi-17.0.2-1.mga2.noarch.rpm
firefox-hr-17.0.2-1.mga2.noarch.rpm
firefox-hu-17.0.2-1.mga2.noarch.rpm
firefox-hy-17.0.2-1.mga2.noarch.rpm
firefox-id-17.0.2-1.mga2.noarch.rpm
firefox-is-17.0.2-1.mga2.noarch.rpm
firefox-it-17.0.2-1.mga2.noarch.rpm
firefox-ja-17.0.2-1.mga2.noarch.rpm
firefox-kk-17.0.2-1.mga2.noarch.rpm
firefox-kn-17.0.2-1.mga2.noarch.rpm
firefox-ko-17.0.2-1.mga2.noarch.rpm
firefox-ku-17.0.2-1.mga2.noarch.rpm
firefox-lg-17.0.2-1.mga2.noarch.rpm
firefox-lt-17.0.2-1.mga2.noarch.rpm
firefox-lv-17.0.2-1.mga2.noarch.rpm
firefox-mai-17.0.2-1.mga2.noarch.rpm
firefox-mk-17.0.2-1.mga2.noarch.rpm
firefox-ml-17.0.2-1.mga2.noarch.rpm
firefox-mr-17.0.2-1.mga2.noarch.rpm
firefox-nb_NO-17.0.2-1.mga2.noarch.rpm
firefox-nl-17.0.2-1.mga2.noarch.rpm
firefox-nn_NO-17.0.2-1.mga2.noarch.rpm
firefox-nso-17.0.2-1.mga2.noarch.rpm
firefox-or-17.0.2-1.mga2.noarch.rpm
firefox-pa_IN-17.0.2-1.mga2.noarch.rpm
firefox-pl-17.0.2-1.mga2.noarch.rpm
firefox-pt_BR-17.0.2-1.mga2.noarch.rpm
firefox-pt_PT-17.0.2-1.mga2.noarch.rpm
firefox-ro-17.0.2-1.mga2.noarch.rpm
firefox-ru-17.0.2-1.mga2.noarch.rpm
firefox-si-17.0.2-1.mga2.noarch.rpm
firefox-sk-17.0.2-1.mga2.noarch.rpm
firefox-sl-17.0.2-1.mga2.noarch.rpm
firefox-sq-17.0.2-1.mga2.noarch.rpm
firefox-sr-17.0.2-1.mga2.noarch.rpm
firefox-sv_SE-17.0.2-1.mga2.noarch.rpm
firefox-ta-17.0.2-1.mga2.noarch.rpm
firefox-ta_LK-17.0.2-1.mga2.noarch.rpm
firefox-te-17.0.2-1.mga2.noarch.rpm
firefox-th-17.0.2-1.mga2.noarch.rpm
firefox-tr-17.0.2-1.mga2.noarch.rpm
firefox-uk-17.0.2-1.mga2.noarch.rpm
firefox-vi-17.0.2-1.mga2.noarch.rpm
firefox-zh_CN-17.0.2-1.mga2.noarch.rpm
firefox-zh_TW-17.0.2-1.mga2.noarch.rpm
firefox-zu-17.0.2-1.mga2.noarch.rpm
libproxy1-0.4.11-1.mga2.i586.rpm
libproxy-devel-0.4.11-1.mga2.i586.rpm
libproxy-gnome-0.4.11-1.mga2.i586.rpm
libproxy-gxsettings-0.4.11-1.mga2.i586.rpm
libproxy-kde-0.4.11-1.mga2.i586.rpm
libproxy-networkmanager-0.4.11-1.mga2.i586.rpm
libproxy-perl-0.4.11-1.mga2.i586.rpm
libproxy-utils-0.4.11-1.mga2.i586.rpm
libproxy-webkit-0.4.11-1.mga2.i586.rpm
python-libproxy-0.4.11-1.mga2.i586.rpm
libnspr4-4.9.4-1.mga2.i586.rpm
libnspr-devel-4.9.4-1.mga2.i586.rpm
libnss3-3.14.1-2.mga2.i586.rpm
libnss-devel-3.14.1-2.mga2.i586.rpm
libnss-static-devel-3.14.1-2.mga2.i586.rpm
nss-3.14.1-2.mga2.i586.rpm
nss-doc-3.14.1-2.mga2.noarch.rpm
rootcerts-20121229.00-2.mga2.i586.rpm
rootcerts-java-20121229.00-2.mga2.i586.rpm

x86_64:
firefox-17.0.2-3.mga2.x86_64.rpm
firefox-devel-17.0.2-3.mga2.x86_64.rpm
firefox-af-17.0.2-1.mga2.noarch.rpm
firefox-ar-17.0.2-1.mga2.noarch.rpm
firefox-ast-17.0.2-1.mga2.noarch.rpm
firefox-be-17.0.2-1.mga2.noarch.rpm
firefox-bg-17.0.2-1.mga2.noarch.rpm
firefox-bn_BD-17.0.2-1.mga2.noarch.rpm
firefox-bn_IN-17.0.2-1.mga2.noarch.rpm
firefox-br-17.0.2-1.mga2.noarch.rpm
firefox-bs-17.0.2-1.mga2.noarch.rpm
firefox-ca-17.0.2-1.mga2.noarch.rpm
firefox-cs-17.0.2-1.mga2.noarch.rpm
firefox-cy-17.0.2-1.mga2.noarch.rpm
firefox-da-17.0.2-1.mga2.noarch.rpm
firefox-de-17.0.2-1.mga2.noarch.rpm
firefox-el-17.0.2-1.mga2.noarch.rpm
firefox-en_GB-17.0.2-1.mga2.noarch.rpm
firefox-en_ZA-17.0.2-1.mga2.noarch.rpm
firefox-eo-17.0.2-1.mga2.noarch.rpm
firefox-es_AR-17.0.2-1.mga2.noarch.rpm
firefox-es_CL-17.0.2-1.mga2.noarch.rpm
firefox-es_ES-17.0.2-1.mga2.noarch.rpm
firefox-es_MX-17.0.2-1.mga2.noarch.rpm
firefox-et-17.0.2-1.mga2.noarch.rpm
firefox-eu-17.0.2-1.mga2.noarch.rpm
firefox-fa-17.0.2-1.mga2.noarch.rpm
firefox-fi-17.0.2-1.mga2.noarch.rpm
firefox-fr-17.0.2-1.mga2.noarch.rpm
firefox-fy-17.0.2-1.mga2.noarch.rpm
firefox-ga_IE-17.0.2-1.mga2.noarch.rpm
firefox-gd-17.0.2-1.mga2.noarch.rpm
firefox-gl-17.0.2-1.mga2.noarch.rpm
firefox-gu_IN-17.0.2-1.mga2.noarch.rpm
firefox-he-17.0.2-1.mga2.noarch.rpm
firefox-hi-17.0.2-1.mga2.noarch.rpm
firefox-hr-17.0.2-1.mga2.noarch.rpm
firefox-hu-17.0.2-1.mga2.noarch.rpm
firefox-hy-17.0.2-1.mga2.noarch.rpm
firefox-id-17.0.2-1.mga2.noarch.rpm
firefox-is-17.0.2-1.mga2.noarch.rpm
firefox-it-17.0.2-1.mga2.noarch.rpm
firefox-ja-17.0.2-1.mga2.noarch.rpm
firefox-kk-17.0.2-1.mga2.noarch.rpm
firefox-kn-17.0.2-1.mga2.noarch.rpm
firefox-ko-17.0.2-1.mga2.noarch.rpm
firefox-ku-17.0.2-1.mga2.noarch.rpm
firefox-lg-17.0.2-1.mga2.noarch.rpm
firefox-lt-17.0.2-1.mga2.noarch.rpm
firefox-lv-17.0.2-1.mga2.noarch.rpm
firefox-mai-17.0.2-1.mga2.noarch.rpm
firefox-mk-17.0.2-1.mga2.noarch.rpm
firefox-ml-17.0.2-1.mga2.noarch.rpm
firefox-mr-17.0.2-1.mga2.noarch.rpm
firefox-nb_NO-17.0.2-1.mga2.noarch.rpm
firefox-nl-17.0.2-1.mga2.noarch.rpm
firefox-nn_NO-17.0.2-1.mga2.noarch.rpm
firefox-nso-17.0.2-1.mga2.noarch.rpm
firefox-or-17.0.2-1.mga2.noarch.rpm
firefox-pa_IN-17.0.2-1.mga2.noarch.rpm
firefox-pl-17.0.2-1.mga2.noarch.rpm
firefox-pt_BR-17.0.2-1.mga2.noarch.rpm
firefox-pt_PT-17.0.2-1.mga2.noarch.rpm
firefox-ro-17.0.2-1.mga2.noarch.rpm
firefox-ru-17.0.2-1.mga2.noarch.rpm
firefox-si-17.0.2-1.mga2.noarch.rpm
firefox-sk-17.0.2-1.mga2.noarch.rpm
firefox-sl-17.0.2-1.mga2.noarch.rpm
firefox-sq-17.0.2-1.mga2.noarch.rpm
firefox-sr-17.0.2-1.mga2.noarch.rpm
firefox-sv_SE-17.0.2-1.mga2.noarch.rpm
firefox-ta-17.0.2-1.mga2.noarch.rpm
firefox-ta_LK-17.0.2-1.mga2.noarch.rpm
firefox-te-17.0.2-1.mga2.noarch.rpm
firefox-th-17.0.2-1.mga2.noarch.rpm
firefox-tr-17.0.2-1.mga2.noarch.rpm
firefox-uk-17.0.2-1.mga2.noarch.rpm
firefox-vi-17.0.2-1.mga2.noarch.rpm
firefox-zh_CN-17.0.2-1.mga2.noarch.rpm
firefox-zh_TW-17.0.2-1.mga2.noarch.rpm
firefox-zu-17.0.2-1.mga2.noarch.rpm
lib64proxy1-0.4.11-1.mga2.x86_64.rpm
lib64proxy-devel-0.4.11-1.mga2.x86_64.rpm
lib64proxy-gnome-0.4.11-1.mga2.x86_64.rpm
lib64proxy-kde-0.4.11-1.mga2.x86_64.rpm
lib64proxy-networkmanager-0.4.11-1.mga2.x86_64.rpm
lib64proxy-webkit-0.4.11-1.mga2.x86_64.rpm
libproxy-gxsettings-0.4.11-1.mga2.x86_64.rpm
libproxy-perl-0.4.11-1.mga2.x86_64.rpm
libproxy-utils-0.4.11-1.mga2.x86_64.rpm
python-libproxy-0.4.11-1.mga2.x86_64.rpm
lib64nspr4-4.9.4-1.mga2.x86_64.rpm
lib64nspr-devel-4.9.4-1.mga2.x86_64.rpm
lib64nss3-3.14.1-2.mga2.x86_64.rpm
lib64nss-devel-3.14.1-2.mga2.x86_64.rpm
lib64nss-static-devel-3.14.1-2.mga2.x86_64.rpm
nss-3.14.1-2.mga2.x86_64.rpm
nss-doc-3.14.1-2.mga2.noarch.rpm
rootcerts-20121229.00-2.mga2.x86_64.rpm
rootcerts-java-20121229.00-2.mga2.x86_64.rpm

SRPMS:
firefox-17.0.2-3.mga2.src.rpm
firefox-l10n-17.0.2-1.mga2.src.rpm
libproxy-0.4.11-1.mga2.src.rpm
nspr-4.9.4-1.mga2.src.rpm
nss-3.14.1-2.mga2.src.rpm
rootcerts-20121229.00-2.mga2.src.rpm

Wiki » Support/Advisories/MGASA-2013-0020

MGASA-2013-0020

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Tools