Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 536564 (CVE-2014-8634) - <www-client/firefox{,-bin}-31.4.0,mail-client/thunderbird{,-bin}-31.4.0: multiple vulnerabilities (CVE-2014-{8634,8635,8636,8637,8638,8639,8640,8641,8642})
Summary: <www-client/firefox{,-bin}-31.4.0,mail-client/thunderbird{,-bin}-31.4.0: mult...
Status: RESOLVED FIXED
Alias: CVE-2014-8634
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa glsa]
Keywords:
Depends on: CVE-2015-0819
Blocks:
  Show dependency tree
 
Reported: 2015-01-14 08:15 UTC by Agostino Sarubbo
Modified: 2015-04-07 10:19 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2015-01-17 23:02:37 UTC
CVE-2014-8642 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8642):
  Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the
  id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP
  responder, which makes it easier for remote attackers to obtain sensitive
  information by sniffing the network during a session in which there was an
  incorrect decision to accept a compromised and revoked certificate.

CVE-2014-8641 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8641):
  Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox
  before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows
  remote attackers to execute arbitrary code via crafted track data.

CVE-2014-8640 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8640):
  The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the
  Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey
  before 2.32 does not properly restrict timeline operations, which allows
  remote attackers to cause a denial of service (uninitialized-memory read and
  application crash) via crafted API calls.

CVE-2014-8639 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8639):
  Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird
  before 31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie
  headers within responses that have a 407 (aka Proxy Authentication Required)
  status code, which allows remote HTTP proxy servers to conduct session
  fixation attacks by providing a cookie name that corresponds to the session
  cookie of the origin server.

CVE-2014-8638 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8638):
  The navigator.sendBeacon implementation in Mozilla Firefox before 35.0,
  Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before
  2.32 omits the CORS Origin header, which allows remote attackers to bypass
  intended CORS access-control checks and conduct cross-site request forgery
  (CSRF) attacks via a crafted web site.

CVE-2014-8637 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8637):
  Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly
  initialize memory for BMP images, which allows remote attackers to obtain
  sensitive information from process memory via a crafted web page that
  triggers the rendering of malformed BMP data within a CANVAS element.

CVE-2014-8636 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8636):
  The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey
  before 2.32 does not properly interact with a DOM object that has a named
  getter, which might allow remote attackers to execute arbitrary JavaScript
  code with chrome privileges via unspecified vectors.

CVE-2014-8635 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8635):
  Multiple unspecified vulnerabilities in the browser engine in Mozilla
  Firefox before 35.0 and SeaMonkey before 2.32 allow remote attackers to
  cause a denial of service (memory corruption and application crash) or
  possibly execute arbitrary code via unknown vectors.

CVE-2014-8634 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8634):
  Multiple unspecified vulnerabilities in the browser engine in Mozilla
  Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4,
  and SeaMonkey before 2.32 allow remote attackers to cause a denial of
  service (memory corruption and application crash) or possibly execute
  arbitrary code via unknown vectors.
Comment 2 Stephan Hartmann 2015-02-07 13:05:09 UTC
What is the status here? I see firefox{,bin} and thunderbird{,bin} were bumped long time ago (not sure about seamonkey).
Comment 3 Jory A. Pratt gentoo-dev 2015-02-07 14:04:55 UTC
(In reply to Stephan Hartmann from comment #2)
> What is the status here? I see firefox{,bin} and thunderbird{,bin} were
> bumped long time ago (not sure about seamonkey).

everything is in the tree, archs can be cc'd
Comment 4 Kristian Fiskerstrand gentoo-dev Security 2015-02-07 15:23:08 UTC
Tracking seamonkey in bug 539242

Arches, please stabilize: 
=www-client/firefox-31.4.0
Stable targets: alpha amd64 arm hppa ia64 ppc pcc64 x86

=www-client/firefox-bin-31.4.0
Stable targets: amd64 x86

=mail-client/thunderbird-31.4.0
Stable targets: amd64 arm ppc ppc64 x86

=mail-client/thunderbird-bin-31.4.0
Stable targets: amd64 x86
Comment 5 Mikle Kolyada archtester Gentoo Infrastructure gentoo-dev Security 2015-02-07 16:47:47 UTC
amd64 stable
Comment 6 Jeroen Roovers gentoo-dev 2015-02-08 10:14:04 UTC
Stable for HPPA.
Comment 7 Agostino Sarubbo gentoo-dev 2015-02-15 15:09:10 UTC
x86 stable
Comment 8 Agostino Sarubbo gentoo-dev 2015-02-18 08:51:05 UTC
ppc64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2015-02-18 09:19:09 UTC
ppc stable
Comment 10 Agostino Sarubbo gentoo-dev 2015-02-23 11:39:38 UTC
ia64 stable
Comment 11 Yury German Gentoo Infrastructure gentoo-dev Security 2015-04-06 05:13:44 UTC
Newer version begin stabilized in Bug #544056

Added to an existing GLSA Request.
Comment 12 GLSAMaker/CVETool Bot gentoo-dev 2015-04-07 10:19:18 UTC
This issue was resolved and addressed in
 GLSA 201504-01 at https://security.gentoo.org/glsa/201504-01
by GLSA coordinator Kristian Fiskerstrand (K_F).