[USN-149-3] Ubuntu 4.10 update for Firefox vulnerabilities

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 07/28/05

Next message: Nate Smith: "Re: Getting round website authentication with Firefox"

Previous message: b0fnet_at_yahoo.com: "Re: LSS Security Advisory: Winamp remote buffer overflow vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Thu, 28 Jul 2005 12:16:31 +0200
To: ubuntu-security-announce@lists.ubuntu.com

===========================================================
Ubuntu Security Notice USN-149-3 July 28, 2005
mozilla-firefox vulnerabilities
CAN-2004-1156, CAN-2004-1381, CAN-2005-0141, CAN-2005-0142,
CAN-2005-0143, CAN-2005-0144, CAN-2005-0145, CAN-2005-0146,
CAN-2005-0147, CAN-2005-0150, CAN-2005-0230, CAN-2005-0231,
CAN-2005-0232, CAN-2005-0233, CAN-2005-0255, CAN-2005-0399,
CAN-2005-0401, CAN-2005-0402, CAN-2005-0578, CAN-2005-0584,
CAN-2005-0585, CAN-2005-0586, CAN-2005-0587, CAN-2005-0588,
CAN-2005-0589, CAN-2005-0590, CAN-2005-0591, CAN-2005-0592,
CAN-2005-0593, CAN-2005-0752, CAN-2005-0989, CAN-2005-1153,
CAN-2005-1154, CAN-2005-1155, CAN-2005-1156, CAN-2005-1157,
CAN-2005-1158, CAN-2005-1159, CAN-2005-1160, CAN-2005-1531,
CAN-2005-1532, CAN-2005-1937, CAN-2005-2260, CAN-2005-2261,
CAN-2005-2262, CAN-2005-2263, CAN-2005-2264, CAN-2005-2265,
CAN-2005-2266, CAN-2005-2267, CAN-2005-2268, CAN-2005-2269,
CAN-2005-2270
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

mozilla-firefox
mozilla-firefox-locale-ca
mozilla-firefox-locale-de
mozilla-firefox-locale-es
mozilla-firefox-locale-fr
mozilla-firefox-locale-it
mozilla-firefox-locale-ja
mozilla-firefox-locale-nb
mozilla-firefox-locale-pl
mozilla-firefox-locale-tr
mozilla-firefox-locale-uk

The problem can be corrected by upgrading the affected package to
version 1.0.6-0ubuntu0.0.1 (mozilla-firefox) and 1.0.6-0ubuntu0.1
(mozilla-firefox-locale-... packages).

Please note that the new version does not work with the already
existing translation packages (mozilla-firefox-locale-...). New
packages have been provided which are compatible to the new Firefox
version of this security update, so they need to be upgraded as well
(a standard system upgrade will take care of this).

After a standard system upgrade you need to restart Firefox to effect
the necessary changes.

We apologize for the huge delay of this update; we changed our update
strategy for Mozilla products to make sure that such long delays will
not happen again.

Details follow:

USN-149-1 fixed some vulnerabilities in the Ubuntu 5.04 (Hoary
Hedgehog) version of Firefox. The version shipped with Ubuntu 4.10
(Warty Warthog) is also vulnerable to these flaws, so it needs to be
upgraded as well. Please see

http://www.ubuntulinux.org/support/documentation/usn/usn-149-1

for the original advisory.

This update also fixes several older vulnerabilities; Some of them
could be exploited to execute arbitrary code with full user privileges
if the user visited a malicious web site. (MFSA-2005-01 to
MFSA-2005-44; please see the following web site for details:
http://www.mozilla.org/projects/security/known-vulnerabilities.html)

Source archives:

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/universe/m/mozilla-firefox/mozilla-firefox-dom-inspector_1.0.6-0ubuntu0.0.1_amd64.deb
      Size/MD5: 147374 1a8aa083386d98e3fb74e6965090acb1
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-firefox/mozilla-firefox_1.0.6-0ubuntu0.0.1_amd64.deb
      Size/MD5: 10673248 f90ed3698968b4609102d6e0737600d7

i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/universe/m/mozilla-firefox/mozilla-firefox-dom-inspector_1.0.6-0ubuntu0.0.1_i386.deb
      Size/MD5: 142280 7988203c7c0c7ff141a551a517a28b1c
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-firefox/mozilla-firefox_1.0.6-0ubuntu0.0.1_i386.deb
      Size/MD5: 9844756 b216dfb17fbdfb90b2deba1b2f1cc4f3

powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/universe/m/mozilla-firefox/mozilla-firefox-dom-inspector_1.0.6-0ubuntu0.0.1_powerpc.deb
      Size/MD5: 141018 4a5925ed52aa151843d3f1cbb1d951c9
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-firefox/mozilla-firefox_1.0.6-0ubuntu0.0.1_powerpc.deb
      Size/MD5: 9502076 2ce0a7d8260fdac867001461a15b6e69

application/pgp-signature attachment: Digital signature

Next message: Nate Smith: "Re: Getting round website authentication with Firefox"

Previous message: b0fnet_at_yahoo.com: "Re: LSS Security Advisory: Winamp remote buffer overflow vulnerability"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[Full-disclosure] [USN-149-2] Fixed Firefox packages for USN-149-1
... mozilla-firefox regressions ... A security issue affects the following Ubuntu releases: ... The following packages are affected: ...
(Full-Disclosure)
[USN-149-2] Fixed Firefox packages for USN-149-1
... mozilla-firefox regressions ... A security issue affects the following Ubuntu releases: ... The following packages are affected: ...
(Bugtraq)
[Full-disclosure] [USN-149-3] Ubuntu 4.10 update for Firefox vulnerabilities
... mozilla-firefox vulnerabilities ... Ubuntu 4.10 ... The following packages are affected: ... USN-149-1 fixed some vulnerabilities in the Ubuntu 5.04 (Hoary ...
(Full-Disclosure)
Apt-build errors
... I am trying to rebuilds several packages that I have already installed. ... If I try to rebuild mozilla-firefox: ... Hit http://http.us.debian.org unstable/main Packages ...
(Debian-User)
[Full-disclosure] [USN-112-1] PHP4 vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... In web applications that automatically process EXIF tags of uploaded ... both vulnerabilities could be exploited remotely. ...
(Full-Disclosure)