RHSA-2015:1834-2: Critical: firefox security update

Red Hat Enterprise Linux: Updated firefox packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5, 6, and 7.

Red Hat Product Security has rated this update as having Critical security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

[Updated 25 August 2014]
This erratum previously included an incorrect list of fixed issues.
The issue list has been updated to reflect the CVEs that were fixed in this
update. The firefox packages provided by this advisory have not been
modified in any way.
CVE-2015-4500, CVE-2015-4506, CVE-2015-4509, CVE-2015-4511, CVE-2015-4517, CVE-2015-4519, CVE-2015-4520, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174, CVE-2015-7175, CVE-2015-7176, CVE-2015-7177, CVE-2015-7180

USN-2744-1: Apport vulnerability

Ubuntu Security Notice USN-2744-1

24th September, 2015

apport vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Apport could be made to crash or overwrite files as an administrator.

Software description

  • apport
    – automatically generate crash reports for debugging

Details

Halfdog discovered that Apport incorrectly handled kernel crash dump files.
A local attacker could use this issue to cause a denial of service, or
possibly elevate privileges. The default symlink protections for affected
releases should reduce the vulnerability to a denial of service.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:
apport

2.17.2-0ubuntu1.5
Ubuntu 14.04 LTS:
apport

2.14.1-0ubuntu3.15
Ubuntu 12.04 LTS:
apport

2.0.1-0ubuntu17.10

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References

CVE-2015-1338

USN-2743-3: Unity Integration for Firefox, Unity Websites Integration and Ubuntu Online Accounts extension update

Ubuntu Security Notice USN-2743-3

24th September, 2015

unity-firefox-extension, webapps-greasemonkey, webaccounts-browser-extension update

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.04
  • Ubuntu 14.04 LTS

Summary

This update provides compatible packages for Firefox 41

Software description

  • unity-firefox-extension
    – Unity Integration for Firefox

  • webaccounts-browser-extension
    – Ubuntu Online Accounts extension for chromium

  • webapps-greasemonkey
    – Firefox extension: Website Integration

Details

USN-2743-1 fixed vulnerabilities in Firefox. Future Firefox updates will
require all addons be signed and unity-firefox-extension, webapps-greasemonkey
and webaccounts-browser-extension will not go through the signing process.
Because these addons currently break search engine installations (LP:
#1069793), this update permanently disables the addons by removing them from
the system.

We apologize for any inconvenience.

Original advisory details:

Andrew Osmond, Olli Pettay, Andrew Sutherland, Christian Holler, David
Major, Andrew McCreight, Cameron McCormack, Bob Clary and Randell Jesup
discovered multiple memory safety issues in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2015-4500, CVE-2015-4501)

André Bargull discovered that when a web page creates a scripted proxy
for the window with a handler defined a certain way, a reference to the
inner window will be passed, rather than that of the outer window.
(CVE-2015-4502)

Felix Gröbert discovered an out-of-bounds read in the QCMS color
management library in some circumstances. If a user were tricked in to
opening a specially crafted website, an attacker could potentially exploit
this to cause a denial of service via application crash, or obtain
sensitive information. (CVE-2015-4504)

Khalil Zhani discovered a buffer overflow when parsing VP9 content in some
circumstances. If a user were tricked in to opening a specially crafted
website, an attacker could potentially exploit this to cause a denial of
service via application crash, or execute arbitrary code with the
privileges of the user invoking Firefox. (CVE-2015-4506)

Spandan Veggalam discovered a crash while using the debugger API in some
circumstances. If a user were tricked in to opening a specially crafted
website whilst using the debugger, an attacker could potentially exploit
this to execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2015-4507)

Juho Nurminen discovered that the URL bar could display the wrong URL in
reader mode in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
conduct URL spoofing attacks. (CVE-2015-4508)

A use-after-free was discovered when manipulating HTML media content in
some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to cause a
denial of service via application crash, or execute arbitrary code with
the privileges of the user invoking Firefox. (CVE-2015-4509)

Looben Yang discovered a use-after-free when using a shared worker with
IndexedDB in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
cause a denial of service via application crash, or execute arbitrary code
with the privileges of the user invoking Firefox. (CVE-2015-4510)

Francisco Alonso discovered an out-of-bounds read during 2D canvas
rendering in some circumstances. If a user were tricked in to opening a
specially crafted website, an attacker could potentially exploit this to
obtain sensitive information. (CVE-2015-4512)

Jeff Walden discovered that changes could be made to immutable properties
in some circumstances. If a user were tricked in to opening a specially
crafted website, an attacker could potentially exploit this to execute
arbitrary script in a privileged scope. (CVE-2015-4516)

Ronald Crane reported multiple vulnerabilities. If a user were tricked in
to opening a specially crafted website, an attacker could potentially
exploit these to cause a denial of service via application crash, or
execute arbitrary code with the privileges of the user invoking Firefox.
(CVE-2015-4517, CVE-2015-4521, CVE-2015-4522, CVE-2015-7174,
CVE-2015-7175, CVE-2015-7176, CVE-2015-7177, CVE-2015-7180)

Mario Gomes discovered that dragging and dropping an image after a
redirect exposes the redirected URL to scripts. An attacker could
potentially exploit this to obtain sensitive information. (CVE-2015-4519)

Ehsan Akhgari discovered 2 issues with CORS preflight requests. An
attacker could potentially exploit these to bypass CORS restrictions.
(CVE-2015-4520)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:
xul-ext-websites-integration

2.3.6+14.10.20140701-0ubuntu1.15.04.1
xul-ext-unity

3.0.0+14.04.20140416-0ubuntu1.15.04.1
xul-ext-webaccounts

0.5-0ubuntu4.15.04.1
Ubuntu 14.04 LTS:
xul-ext-websites-integration

2.3.6+13.10.20130920.1-0ubuntu1.2
xul-ext-unity

3.0.0+14.04.20140416-0ubuntu1.14.04.1
xul-ext-webaccounts

0.5-0ubuntu2.14.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

LP: 1069793,

LP: 1498681

USN-2745-1: QEMU vulnerabilities

Ubuntu Security Notice USN-2745-1

24th September, 2015

qemu, qemu-kvm vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in QEMU.

Software description

  • qemu
    – Machine emulator and virtualizer

  • qemu-kvm
    – Machine emulator and virtualizer

Details

Lian Yihan discovered that QEMU incorrectly handled certain payload
messages in the VNC display driver. A malicious guest could use this issue
to cause the QEMU process to hang, resulting in a denial of service. This
issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-5239)

Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause the QEMU process to hang, resulting in a denial of service.
(CVE-2015-5278)

Qinghao Tang discovered that QEMU incorrectly handled receiving certain
packets in the NE2000 network driver. A malicious guest could use this
issue to cause a denial of service, or possibly execute arbitrary code on
the host as the user running the QEMU process. In the default installation,
when QEMU is used with libvirt, attackers would be isolated by the libvirt
AppArmor profile. (CVE-2015-5279)

Qinghao Tang discovered that QEMU incorrectly handled transmit descriptor
data when sending network packets. A malicious guest could use this issue
to cause the QEMU process to hang, resulting in a denial of service.
(CVE-2015-6815)

Qinghao Tang discovered that QEMU incorrectly handled ATAPI command
permissions. A malicious guest could use this issue to cause the QEMU
process to crash, resulting in a denial of service. (CVE-2015-6855)

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:
qemu-system-misc

1:2.2+dfsg-5expubuntu9.5
qemu-system

1:2.2+dfsg-5expubuntu9.5
qemu-system-aarch64

1:2.2+dfsg-5expubuntu9.5
qemu-system-x86

1:2.2+dfsg-5expubuntu9.5
qemu-system-sparc

1:2.2+dfsg-5expubuntu9.5
qemu-system-arm

1:2.2+dfsg-5expubuntu9.5
qemu-system-ppc

1:2.2+dfsg-5expubuntu9.5
qemu-system-mips

1:2.2+dfsg-5expubuntu9.5
Ubuntu 14.04 LTS:
qemu-system-misc

2.0.0+dfsg-2ubuntu1.19
qemu-system

2.0.0+dfsg-2ubuntu1.19
qemu-system-aarch64

2.0.0+dfsg-2ubuntu1.19
qemu-system-x86

2.0.0+dfsg-2ubuntu1.19
qemu-system-sparc

2.0.0+dfsg-2ubuntu1.19
qemu-system-arm

2.0.0+dfsg-2ubuntu1.19
qemu-system-ppc

2.0.0+dfsg-2ubuntu1.19
qemu-system-mips

2.0.0+dfsg-2ubuntu1.19
Ubuntu 12.04 LTS:
qemu-kvm

1.0+noroms-0ubuntu14.25

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart all QEMU virtual
machines to make all the necessary changes.

References

CVE-2015-5239,

CVE-2015-5278,

CVE-2015-5279,

CVE-2015-6815,

CVE-2015-6855

USN-2746-1: Simple Streams vulnerability

Ubuntu Security Notice USN-2746-1

24th September, 2015

simplestreams vulnerability

A security issue affects these releases of Ubuntu and its
derivatives:

  • Ubuntu 15.04
  • Ubuntu 14.04 LTS

Summary

Applications using Simple Streams could be made to crash or run
programs if it received specially crafted network traffic.

Software description

  • simplestreams
    – Library and tools for using Simple Streams data

Details

It was discovered that Simple Streams did not properly perform gpg
verification in some situations. A remote attacker could use this to
perform a man-in-the-middle attack and inject malicious content into
the stream.

Update instructions

The problem can be corrected by updating your system to the following
package version:

Ubuntu 15.04:
python-simplestreams

0.1.0~bzr354-0ubuntu1.15.04.1
simplestreams

0.1.0~bzr354-0ubuntu1.15.04.1
python-simplestreams-openstack

0.1.0~bzr354-0ubuntu1.15.04.1
python3-simplestreams

0.1.0~bzr354-0ubuntu1.15.04.1
Ubuntu 14.04 LTS:
python-simplestreams

0.1.0~bzr341-0ubuntu2.2
simplestreams

0.1.0~bzr341-0ubuntu2.2
python-simplestreams-openstack

0.1.0~bzr341-0ubuntu2.2
python3-simplestreams

0.1.0~bzr341-0ubuntu2.2

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart any services that
make use of python-simplestreams or python3-simplestreams to make
all the necessary changes.

References

CVE-2015-1337

Red Hat Security Advisory 2015-1837-01

Red Hat Security Advisory 2015-1837-01 – KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM. A heap-based buffer overflow issue was found in the QEMU emulator’s VNC display driver. It could occur while refreshing the VNC server’s display surface using the vnc_refresh_server_surface() routine. A privileged guest user could use this flaw to corrupt the heap memory and crash the QEMU process instance, or to potentially use it to execute arbitrary code on the host.