MGASA-2014-0293

Dashboard / Vulnerabilities / MGASA-2014-0293

MGASA-2014-0293

Summary: Updated nss, firefox and thunderbird packages fix security vulnerabilities

Details: A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application (CVE-2014-1544). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2014-1547, CVE-2014-1555, CVE-2014-1556, CVE-2014-1557). The rootcerts and nss packages have been updated to NSS 3.16.3, and the firefox and thunderbird packages have been updated to version 24.7.0, fixing these issues.

References: https://advisories.mageia.org/MGASA-2014-0293.html, https://bugs.mageia.org/show_bug.cgi?id=13790, https://www.mozilla.org/security/announce/2014/mfsa2014-56.html, https://www.mozilla.org/security/announce/2014/mfsa2014-61.html, https://www.mozilla.org/security/announce/2014/mfsa2014-62.html, https://www.mozilla.org/security/announce/2014/mfsa2014-63.html, https://www.mozilla.org/security/announce/2014/mfsa2014-64.html, http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html, http://www.mozilla.org/security/known-vulnerabilities/thunderbird.html, https://rhn.redhat.com/errata/RHSA-2014-0919.html, https://rhn.redhat.com/errata/RHSA-2014-0918.html, https://rhn.redhat.com/errata/RHSA-2014-0917.html