Advisories ยป MGASA-2015-0115

Updated firefox packages fix security vulnerabilities

Publication date: 23 Mar 2015
Modification date: 23 Mar 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2015-0817 , CVE-2015-0818

Description

A flaw was discovered in the implementation of typed array bounds checking
in the Javascript just-in-time compilation. If a user were tricked in to
opening a specially crafted website, an attacked could exploit this to
execute arbitrary code with the privileges of the user invoking Firefox
(CVE-2015-0817).

Mariusz Mlynski discovered a flaw in the processing of SVG format content
navigation. If a user were tricked in to opening a specially crafted
website, an attacker could exploit this to run arbitrary script in a
privileged context (CVE-2015-0818).

The firefox package has been updated to version 31.5.3 to fix these issues.

Also, the nss package has been updated to version 3.18, which enables TLS
and DTLS 1.2, increases the default RSA key size created by certutil to 2048
bits, and has some CA root certificate updates.

References

SRPMS

4/core