[BSA-027] Security Update for iceweasel

2011-03-17T10:44:52
ID DEBIAN:BSA-027:63E51
Type debian
Reporter Debian
Modified 2011-03-17T10:44:52

Description

Mike Hommey uploaded new packages for iceweasel which fixed the following security problems:

CVE-2010-1585

Roberto Suggi Liverani discovered that the sanitising performed by ParanoidFragmentSink was incomplete.

CVE-2011-0053

Crashes in the layout engine may lead to the execution of arbitrary code.

CVE-2011-0051

Zach Hoffmann discovered that incorrect parsing of recursive eval() calls could lead to attackers forcing acceptance of a confirmation dialogue.

CVE-2011-0054, CVE-2010-0056

Christian Holler discovered buffer overflows in the Javascript engine, which could allow the execution of arbitrary code.

CVE-2011-0055

"regenrecht" and Igor Bukanov discovered a use-after-free error in the JSON-Implementation, which could lead to the execution of arbitrary code.

CVE-2011-0057

Daniel Kozlowski discovered that incorrect memory handling the web workers implementation could lead to the execution of arbitrary code.

CVE-2011-0059

Peleus Uhley discovered a cross-site request forgery risk in the plugin code.

For the lenny-backports distribution the problems have been fixed in version 3.5.16-5~bpo50+1.

For the oldstable distribution (lenny), this problem has been fixed in version 1.9.0.19-8 of the xulrunner source package.

For the stable distribution (squeeze), this problem has been fixed in version 3.5.16-5.

For the unstable distribution (sid), this problem has been fixed in version 3.5.17-1.

Upgrade instructions

If you don't use pinning (see [1]) you have to update the package manually via "apt-get -t lenny-backports install <packagelist>" with the packagelist of your installed packages affected by this update. [1] <http://backports.debian.org/Instructions>

We recommend to pin (in /etc/apt/preferences) the backports repository to 200 so that new versions of installed backports will be installed automatically.

Package: * Pin: release a=lenny-backports Pin-Priority: 200