Bug 38271 - Iceweasel: Security issues from 31.6 (4.0)
Iceweasel: Security issues from 31.6 (4.0)
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P5 normal (vote)
: UCS 4.0-1-errata
Assigned To: Arvid Requate
Janek Walkenhorst
Depends on:
  Show dependency treegraph
Reported: 2015-04-15 16:36 CEST by Arvid Requate
Modified: 2015-05-07 17:46 CEST (History)
0 users

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:


Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-04-15 16:36:49 CEST
ucs4.0-1 shipped 31.4.0esr-1. A couple of vulnerabilities have been fixed:

Fixed in 31.5.0esr-1~deb7u1:

* Reading of local files through manipulation of form autocomplete (CVE-2015-0822)
* Out-of-bounds read and write while rendering SVG content (CVE-2015-0827)
* Use-after-free in IndexedDB (CVE-2015-0831)
* Miscellaneous memory safety hazards (CVE-2015-0836)

Fixed in 31.5.3esr-1~deb7u1:

* Reading and writing of memory allowing for arbitary code execution on the local system (Pwn2Own asm.js exploit) (CVE-2015-0817)

* Run arbitrary scripts in a privileged context (Same-origin bypass via SVG hash navigation) (CVE-2015-0818)

Fixed in 31.6.0esr-1~deb7u1:

* Same-origin bypass through anchor navigation (CVE-2015-0801)

* Potential XSRF affecting sendBeacon() requests (CORS requests should not follow 30x redirections after prefligh) (CVE-2015-0807)

* Use-after-free when using the Fluendo MP3 GStreamer plugin (CVE-2015-0813)

* Memory safety bugs (CVE-2015-0815)

* resource:// documents can load privileged pages (CVE-2015-0816)

Additionally, rebuilding the package now will fix the exposure to the macro
Bug #38250
Comment 1 Arvid Requate univentionstaff 2015-04-15 22:07:51 CEST
The DSA version has been imported and built in errata4.0-1.

Advisory: 2015-04-15-iceweasel.yaml
Comment 2 Janek Walkenhorst univentionstaff 2015-05-06 15:47:30 CEST
Advisory: OK
Tests: OK
Changelog: OK
Comment 3 Janek Walkenhorst univentionstaff 2015-05-07 17:46:00 CEST