CVE-2011-1187, CVE-2012-0475, CVE-2013-{0773,0775,0776,0780,0782,0783}

Debian Bug report logs - #703071
CVE-2011-1187, CVE-2012-0475, CVE-2013-{0773,0775,0776,0780,0782,0783}

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Arne Wichmann <aw@anhrefn.saar.de>

To: submit@bugs.debian.org

Subject: CVE-2011-1187, CVE-2012-0475, CVE-2013-{0773,0775,0776,0780,0782,0783}

Date: Thu, 14 Mar 2013 23:05:28 +0100

Package: iceweasel
Severity: grave
Tags: security

Hi,
the following vulnerabilities were published for iceweasel.

(I am aware that these are fixed in experimental, but they should also be
fixed in testing and stable. If I can be of assistance please indicate so.)

CVE-2011-1187[0]:
| Google Chrome before 10.0.648.127 allows remote attackers to bypass
| the Same Origin Policy via unspecified vectors, related to an "error
| message leak."

CVE-2012-0475[1]:
| Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and
| SeaMonkey before 2.9 do not properly construct the Origin and
| Sec-WebSocket-Origin HTTP headers, which might allow remote attackers
| to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or
| (2) WebSocket operation involving a nonstandard port number and an
| IPv6 address that contains certain zero fields.

CVE-2013-0773[2]:
| The Chrome Object Wrapper (COW) and System Only Wrapper (SOW)
| implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x
| before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before
| 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a
| prototype, which allows remote attackers to obtain sensitive
| information from chrome objects or possibly execute arbitrary
| JavaScript code with chrome privileges via a crafted web site.

CVE-2013-0775[3]:
| Use-after-free vulnerability in the
| nsImageLoadingContent::OnStopContainer function in Mozilla Firefox
| before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before
| 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16
| allows remote attackers to execute arbitrary code via crafted web
| script.

CVE-2013-0780[4]:
| Use-after-free vulnerability in the
| nsOverflowContinuationTracker::Finish function in Mozilla Firefox
| before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before
| 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16
| allows remote attackers to execute arbitrary code or cause a denial of
| service (heap memory corruption) via a crafted document that uses
| Cascading Style Sheets (CSS) -moz-column-* properties.

CVE-2013-0782[5]:
| Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion
| function in Mozilla Firefox before 19.0, Firefox ESR 17.x before
| 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3,
| and SeaMonkey before 2.16 allows remote attackers to execute arbitrary
| code via unspecified vectors.

CVE-2013-0783[6]:
| Multiple unspecified vulnerabilities in the browser engine in Mozilla
| Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird
| before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey
| before 2.16 allow remote attackers to cause a denial of service
| (memory corruption and application crash) or possibly execute
| arbitrary code via unknown vectors.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1187
    http://security-tracker.debian.org/tracker/CVE-2011-1187
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0475
    http://security-tracker.debian.org/tracker/CVE-2012-0475
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0773
    http://security-tracker.debian.org/tracker/CVE-2013-0773
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0775
    http://security-tracker.debian.org/tracker/CVE-2013-0775
[4] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0780
    http://security-tracker.debian.org/tracker/CVE-2013-0780
[5] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0782
    http://security-tracker.debian.org/tracker/CVE-2013-0782
[6] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0783
    http://security-tracker.debian.org/tracker/CVE-2013-0783
Please adjust the affected versions in the BTS as needed.

cu

AW
-- 
[...] If you don't want to be restricted, don't agree to it. If you are
coerced, comply as much as you must to protect yourself, just don't support
it. Noone can free you but yourself. (crag, on Debian Planet)
Arne Wichmann (aw@linux.de)

Message #12 received at 703071@bugs.debian.org (full text, mbox, reply):

From: Arne Wichmann <aw@anhrefn.saar.de>

To: 703071@bugs.debian.org

Subject: Re: CVE-2011-1187, CVE-2012-0475, CVE-2013-{0773,0775,0776,0780,0782,0783}

Date: Tue, 30 Apr 2013 14:05:23 +0200

[Message part 1 (text/plain, inline)]

This grave bug is no open for more than a month with no action on it. Do
you have any plans to do something about it or shall wheezy be released
with arbitrary code executions in iceweasel?

cu

AW
-- 
[...] If you don't want to be restricted, don't agree to it. If you are
coerced, comply as much as you must to protect yourself, just don't support
it. Noone can free you but yourself. (crag, on Debian Planet)
Arne Wichmann (aw@linux.de)

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 703071-done@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: 703071-done@bugs.debian.org

Subject: Re: CVE-2011-1187, CVE-2012-0475, CVE-2013-{0773,0775,0776,0780,0782,0783}

Date: Mon, 3 Jun 2013 18:25:05 +0200

Version: 17.0.5esr-1

Send a report that this bug log contains spam.