MGASA-2014-0137

Dashboard / Vulnerabilities / MGASA-2014-0137

MGASA-2014-0137

Summary: Updated nss, firefox and thunderbird packages fix security vulnerabilities

Details: In the NSS library before version 3.16, in a wildcard certificate, the wildcard character was embedded within the U-label of an internationalized domain name, which is not in accordance with RFC 6125 (CVE-2014-1492). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514). Several information disclosure flaws were found in the way Firefox and Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox or Thunderbird to crash (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505). A memory corruption flaw was found in the way Firefox and Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox or Thunderbird (CVE-2014-1509).

References: https://advisories.mageia.org/MGASA-2014-0137.html, https://bugs.mageia.org/show_bug.cgi?id=13042, https://www.mozilla.org/security/announce/2014/mfsa2014-15.html, https://www.mozilla.org/security/announce/2014/mfsa2014-17.html, https://www.mozilla.org/security/announce/2014/mfsa2014-26.html, https://www.mozilla.org/security/announce/2014/mfsa2014-27.html, https://www.mozilla.org/security/announce/2014/mfsa2014-28.html, https://www.mozilla.org/security/announce/2014/mfsa2014-29.html, https://www.mozilla.org/security/announce/2014/mfsa2014-30.html, https://www.mozilla.org/security/announce/2014/mfsa2014-31.html, https://www.mozilla.org/security/announce/2014/mfsa2014-32.html, https://developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes, http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html, https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html, https://rhn.redhat.com/errata/RHSA-2014-0310.html