Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2008-01] firefox, thunderbird, and seamonkey crashes with memory corruption fix

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: SM-Security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] [SMGLSA-2008-01] firefox, thunderbird, and seamonkey crashes with memory corruption fix
  • Date: Sat, 19 Apr 2008 00:10:05 -0700

Synopsis
========
A crash vulnerability was found in firefox that were fixed with the firefox
2.0.0.14 release. Note that their release *lies* and there are no new
releases for thunderbird nor seamonkey.

Background
==========
Firefox is the official web browser release of the Mozilla project.

Description
===========
Fixes for security problems in the JavaScript engine described in MFSA
2008-15 (CVE-2008-1237) introduced a stability problem, where some users
experienced crashes during JavaScript garbage collection. This is being fixed
primarily to address stability concerns. We have no demonstration that this
particular crash is exploitable but are issuing this advisory because some
crashes of this type have been shown to be exploitable in the past.[0]

Affected packages
=================
These vulnerabilities were reported for firefox 2.0.0.13. firefox in all
grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in stable-rc and stable grimoires.

Resolution
==========
All firefox users should upgrade to the latest available version:
# scribe update
# cast -c firefox

If you maintain your own installation of firefox ouside of sorcery, there are
patches available from upstream, please visit the bugzilla page[1] for
information.

References
==========
[0] http://www.mozilla.org/security/announce/2008/mfsa2008-20.html
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=425576
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1380

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | http://counter.li.org/ #196285

Attachment: signature.asc
Description: This is a digitally signed message part.



  • [SM-Security] [SMGLSA-2008-01] firefox, thunderbird, and seamonkey crashes with memory corruption fix, Eric Sandall, 04/19/2008

Archive powered by MHonArc 2.6.24.

Top of Page