Security Information / 2012 / Security Information -- DSA-2433-1 iceweasel

Debian Security Advisory

DSA-2433-1 iceweasel -- several vulnerabilities

Date Reported:

15 Mar 2012

Affected Packages:

iceweasel

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2012-0455, CVE-2012-0456, CVE-2012-0458, CVE-2012-0461.

More information:

Several vulnerabilities have been discovered in Iceweasel, a web browser based on Firefox. The included XULRunner library provides rendering services for several other applications included in Debian.

• CVE-2012-0455

  Soroush Dalili discovered that a cross-site scripting countermeasure related to JavaScript URLs could be bypassed.

• CVE-2012-0456

  Atte Kettunen discovered an out of bounds read in the SVG Filters, resulting in memory disclosure.

• CVE-2012-0458

  Mariusz Mlynski discovered that privileges could be escalated through a JavaScript URL as the home page.

• CVE-2012-0461

  Bob Clary discovered memory corruption bugs, which may lead to the execution of arbitrary code.

For the stable distribution (squeeze), this problem has been fixed in version 3.5.16-13.

For the unstable distribution (sid), this problem has been fixed in version 10.0.3esr-1.

For the experimental distribution, this problem has been fixed in version 11.0-1.

We recommend that you upgrade your iceweasel packages.