MGASA-2015-0025
- Source
- https://advisories.mageia.org/MGASA-2015-0025.html
- Import Source
- https://advisories.mageia.org/MGASA-2015-0025.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2015-0025
- Upstream
- Published
- 2015-01-17T22:31:08Z
- Modified
- 2026-04-16T06:23:54.087145426Z
- Summary
- Updated firefox and thunderbird packages fixes security vulnerabilities
- Details
-
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2014-8634).
It was found that the Beacon interface implementation in Firefox and Thunderbird did not follow the Cross-Origin Resource Sharing (CORS) specification. A web page containing malicious content could allow a remote attacker to conduct a Cross-Site Request Forgery (XSRF) attack (CVE-2014-8638).
It was found that a Web Proxy returning a 407 Proxy Authentication response with a Set-Cookie header could inject cookies into the originally requested domain. This could be used for session-fixation attacks. This attack only allows cookies to be written but does not allow them to be read (CVE-2014-8639).
Security researcher Mitchell Harper discovered a read-after-free in WebRTC due to the way tracks are handled. This results in a either a potentially exploitable crash or incorrect WebRTC behavior. Note that this issue only affects Firefox (CVE-2014-8641).
- References
-
- https://advisories.mageia.org/MGASA-2015-0025.html
- https://bugs.mageia.org/show_bug.cgi?id=15040
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/
- https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/
- https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/
- https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/
- https://rhn.redhat.com/errata/RHSA-2015-0046.html
- https://rhn.redhat.com/errata/RHSA-2015-0047.html
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:4 / firefox
Package
- Name
- firefox
- Purl
- pkg:rpm/mageia/firefox?arch=source&distro=mageia-4
Mageia:4 / firefox-l10n
Package
- Name
- firefox-l10n
- Purl
- pkg:rpm/mageia/firefox-l10n?arch=source&distro=mageia-4
Mageia:4 / thunderbird
Package
- Name
- thunderbird
- Purl
- pkg:rpm/mageia/thunderbird?arch=source&distro=mageia-4
Mageia:4 / thunderbird-l10n
Package
- Name
- thunderbird-l10n
- Purl
- pkg:rpm/mageia/thunderbird-l10n?arch=source&distro=mageia-4