AXSA:2016-107:02

Release date: 
Thursday, February 18, 2016 - 12:03
Subject: 
firefox-38.6.1-1.0.1.AXS4
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
High
Description: 

Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance and portability.

Security issues fixed with this release:

CVE-2016-1521
The directrun function in directmachine.cpp in Libgraphite in Graphite
2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox ESR 38.x
before 38.6.1, does not validate a certain skip operation, which
allows remote attackers to execute arbitrary code, obtain sensitive
information, or cause a denial of service (out-of-bounds read and
application crash) via a crafted Graphite smart font.
CVE-2016-1522
Code.cpp in Libgraphite in Graphite 2 1.2.4, as used in Mozilla
Firefox before 43.0 and Firefox ESR 38.x before 38.6.1, does not
consider recursive load calls during a size check, which allows remote
attackers to cause a denial of service (heap-based buffer overflow) or
possibly execute arbitrary code via a crafted Graphite smart font.
CVE-2016-1523
The SillMap::readFace function in FeatureMap.cpp in Libgraphite in
Graphite 2 1.2.4, as used in Mozilla Firefox before 43.0 and Firefox
ESR 38.x before 38.6.1, mishandles a return value, which allows remote
attackers to cause a denial of service (missing initialization, NULL
pointer dereference, and application crash) via a crafted Graphite
smart font.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. firefox-38.6.1-1.0.1.AXS4.src.rpm
    MD5: f9c921f0e0d4e43a826dc80ffc45c38c
    SHA-256: 74b540bbe53f04ed1acde66c11532ae6a19c59c8956d2806993fda118ee6ee2e
    Size: 319.66 MB

Asianux Server 4 for x86
  1. firefox-38.6.1-1.0.1.AXS4.i686.rpm
    MD5: f8215ea62c892b70f0a69ca529a11f72
    SHA-256: 40c69b7e99e13f07b9a558f895ed9ec488e8a34d35e3a8ac8f27ef0923883cee
    Size: 70.37 MB

Asianux Server 4 for x86_64
  1. firefox-38.6.1-1.0.1.AXS4.x86_64.rpm
    MD5: 53ee4525f45b3a543c239aadab153954
    SHA-256: 3fd988b431c1a890e26c0cf9fa06239fd44fb48dc7cfe89fae9070b7f3bcfee2
    Size: 69.65 MB
  2. firefox-38.6.1-1.0.1.AXS4.i686.rpm
    MD5: f8215ea62c892b70f0a69ca529a11f72
    SHA-256: 40c69b7e99e13f07b9a558f895ed9ec488e8a34d35e3a8ac8f27ef0923883cee
    Size: 70.37 MB
Copyright© 2007-2015 Asianux. All rights reserved.