67 lines
5.5 KiB
JSON
67 lines
5.5 KiB
JSON
{
|
|
"schema_version": "1.7.0",
|
|
"id": "USN-2702-2",
|
|
"summary": "ubufox update",
|
|
"details": "USN-2702-1 fixed vulnerabilities in Firefox. This update provides the\ncorresponding updates for Ubufox.\n\nOriginal advisory details:\n\n Gary Kwong, Christian Holler, Byron Campen, Tyson Smith, Bobby Holley,\n Chris Coulson, and Eric Rahm discovered multiple memory safety issues in\n Firefox. If a user were tricked in to opening a specially crafted website,\n an attacker could potentially exploit these to cause a denial of service\n via application crash, or execute arbitrary code with the privileges of\n the user invoking Firefox. (CVE-2015-4473, CVE-2015-4474)\n \n Aki Helin discovered an out-of-bounds read when playing malformed MP3\n content in some circumstances. If a user were tricked in to opening a\n specially crafted website, an attacker could potentially exploit this to\n obtain sensitive information, cause a denial of service via application\n crash, or execute arbitrary code with the privileges of the user invoking\n Firefox. (CVE-2015-4475)\n \n A use-after-free was discovered during MediaStream playback in some\n circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service via application crash or execute arbitrary code with the\n priviliges of the user invoking Firefox. (CVE-2015-4477)\n \n Andr\u00e9 Bargull discovered that non-configurable properties on javascript\n objects could be redefined when parsing JSON. If a user were tricked in to\n opening a specially crafted website, an attacker could potentially exploit\n this to bypass same-origin restrictions. (CVE-2015-4478)\n \n Multiple integer overflows were discovered in libstagefright. If a user\n were tricked in to opening a specially crafted website, an attacker could\n potentially exploit these to cause a denial of service via application\n crash, or execute arbitrary code with the privileges of the user invoking\n Firefox. (CVE-2015-4479, CVE-2015-4480, CVE-2015-4493)\n \n Jukka Jyl\u00e4nki discovered a crash that occurs because javascript does not\n properly gate access to Atomics or SharedArrayBuffers in some\n circumstances. If a user were tricked in to opening a specially crafted\n website, an attacker could potentially exploit this to cause a denial of\n service. (CVE-2015-4484)\n \n Abhishek Arya discovered 2 buffer overflows in libvpx when decoding\n malformed WebM content in some circumstances. If a user were tricked in\n to opening a specially crafted website, an attacker could potentially\n exploit these to cause a denial of service via application crash, or\n execute arbitrary code with the privileges of the user invoking Firefox.\n (CVE-2015-4485, CVE-2015-4486)\n \n Ronald Crane reported 3 security issues. If a user were tricked in to\n opening a specially crafted website, an attacker could potentially\n exploit these, in combination with another security vulnerability, to\n cause a denial of service via application crash, or execute arbitrary\n code with the privileges of the user invoking Firefox. (CVE-2015-4487,\n CVE-2015-4488, CVE-2015-4489)\n \n Christoph Kerschbaumer discovered an issue with Mozilla's implementation\n of Content Security Policy (CSP), which could allow for a more permissive\n usage in some cirucumstances. An attacker could potentially exploit this\n to conduct cross-site scripting (XSS) attacks. (CVE-2015-4490)\n \n Gustavo Grieco discovered a heap overflow in gdk-pixbuf. If a user were\n tricked in to opening a specially crafted website, an attacker could\n potentially exploit this to cause a denial of service via application\n crash or execute arbitrary code with the priviliges of the user invoking\n Firefox. (CVE-2015-4491)\n \n Looben Yang discovered a use-after-free when using XMLHttpRequest with\n shared workers in some circumstances. If a user were tricked in to opening\n a specially crafted website, an attacker could potentially exploit this to\n cause a denial of service via application crash or execute arbitrary code\n with the priviliges of the user invoking Firefox. (CVE-2015-4492)\n",
|
|
"aliases": [],
|
|
"upstream": [],
|
|
"related": [],
|
|
"published": "2015-08-11T18:48:40Z",
|
|
"modified": "2026-02-10T04:40:55Z",
|
|
"affected": [
|
|
{
|
|
"package": {
|
|
"ecosystem": "Ubuntu:14.04:LTS",
|
|
"name": "ubufox",
|
|
"purl": "pkg:deb/ubuntu/ubufox@3.1-0ubuntu0.14.04.1?arch=source&distro=trusty"
|
|
},
|
|
"ranges": [
|
|
{
|
|
"type": "ECOSYSTEM",
|
|
"events": [
|
|
{
|
|
"introduced": "0"
|
|
},
|
|
{
|
|
"fixed": "3.1-0ubuntu0.14.04.1"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"versions": [
|
|
"2.8-0ubuntu1",
|
|
"2.9-0ubuntu0.14.04.1",
|
|
"3.0-0ubuntu0.14.04.1"
|
|
],
|
|
"ecosystem_specific": {
|
|
"binaries": [
|
|
{
|
|
"binary_name": "ubufox",
|
|
"binary_version": "3.1-0ubuntu0.14.04.1"
|
|
},
|
|
{
|
|
"binary_name": "xul-ext-ubufox",
|
|
"binary_version": "3.1-0ubuntu0.14.04.1"
|
|
}
|
|
],
|
|
"availability": "No subscription required"
|
|
},
|
|
"database_specific": {
|
|
"cves_map": {
|
|
"ecosystem": "Ubuntu:14.04:LTS",
|
|
"cves": []
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"type": "ADVISORY",
|
|
"url": "https://ubuntu.com/security/notices/USN-2702-2"
|
|
},
|
|
{
|
|
"type": "REPORT",
|
|
"url": "https://launchpad.net/bugs/1483858"
|
|
}
|
|
]
|
|
} |