firefox-24.5.0-1.0.1.AXS3

エラータID: AXSA:2014-327:02

リリース日: 
2014/05/19 Monday - 13:20
題名: 
firefox-24.5.0-1.0.1.AXS3
影響のあるチャネル: 
Asianux Server 3 for x86_64
Asianux Server 3 for x86
Severity: 
High
Description: 

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.

Security issues fixed with this release:

• CVE-2014-1518
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

• CVE-2014-1523
Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.

• CVE-2014-1524
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.

• CVE-2014-1529
The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.

• CVE-2014-1530
The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation.

• CVE-2014-1531
Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.

• CVE-2014-1532
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.

解決策: 

Update packages.

追加情報: 

N/A

ダウンロード: 

SRPMS
  1. firefox-24.5.0-1.0.1.AXS3.src.rpm
    MD5: cd78921b7de320298806019f726e1eb4
    SHA-256: cd0f2fa6f239639c4dbd8eb25c1efcea25a26590259bc220bdfad7a37a3bbe3b
    Size: 138.09 MB

Asianux Server 3 for x86
  1. firefox-24.5.0-1.0.1.AXS3.i386.rpm
    MD5: d1cdd560191b4f037373e5eeecdf22ef
    SHA-256: a3523f6f59345641d637d52d9534ed33d3a3d297e3319ed6180d88e59ae411a3
    Size: 49.10 MB

Asianux Server 3 for x86_64
  1. firefox-24.5.0-1.0.1.AXS3.x86_64.rpm
    MD5: 6ebda40117d3f72e73e9e084fef86c47
    SHA-256: fb7cf139e86b2ae75668df8565b5861cb24eeb5a8d6009c3d7a1992e457cd26b
    Size: 50.21 MB