copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2016.0728 - [Debian] iceweasel: Multiple vulnerabilities

Date: 21 March 2016
References: ASB-2016.0025  ESB-2016.0635  ESB-2016.0639  ESB-2016.0673  ESB-2016.0767  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2016.0728
                         iceweasel security update
                               21 March 2016

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           iceweasel
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
                   Debian GNU/Linux 8
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2016-2802 CVE-2016-2801 CVE-2016-2800
                   CVE-2016-2799 CVE-2016-2798 CVE-2016-2797
                   CVE-2016-2796 CVE-2016-2795 CVE-2016-2794
                   CVE-2016-2793 CVE-2016-2792 CVE-2016-2791
                   CVE-2016-2790 CVE-2016-1977 

Reference:         ASB-2016.0025
                   ESB-2016.0673
                   ESB-2016.0639
                   ESB-2016.0635

Original Bulletin: 
   http://www.debian.org/security/2016/dsa-3523

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3523-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
March 20, 2016                        https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : iceweasel
CVE ID         : not available

This update disables the Graphite font shaping library in Iceweasel,
Debian's version of the Mozilla Firefox web browser.

For the oldstable distribution (wheezy), this problem has been fixed
in version 38.7.1esr-1~deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 38.7.1esr-1~deb8u1.

For the unstable distribution (sid), this problem has been fixed in
version 45.0.1esr-1 of the firefox-esr source package.

We recommend that you upgrade your iceweasel packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJW7x2VAAoJEBDCk7bDfE420mwP/jwTKmR4IA/Zc5juA32bBqtz
rlkqnFIJfCL9ZfML7gQxspiYg+6kPLzLOI2O34MPKMwdHpNCkR4KMxBefm8WA662
WfY+ZtaBfit0p4mk/cnTHQz2PYWGllFYxifxm6Wvt9N9tDFy8eROFTdD1/XOWOoc
9PHJoL6j5oPJ8napEdzk8la4vdlL5kiVTDPz+2Ug4je9IHrXG/H5m6ssbxOS1q44
4zzo0mwNfzRVic3td2ilgKIoUAmsbnfIjaRRnwxoww5kJl/hdKCEFIKStYH/sP9m
LdO/KbEeari1jypJ8/DhyrsW7Jtp6fdnlIIole2FpValgaeFGn7M+yeemBr1fBdH
aIqT2Uiu9o0i6oZCGnS7ml7c1OoyHXPvI0QghLF0jfSsKWMuuFnZJO1bc1wKyYAU
E0LpsWGqJNMrt/p75e43kSWkExxdM8C0ryScPToFOHNTRQrds9fJ6jXHm+5finek
TkprP+GT5qgSfb2l0dF+dVr0bkA8WlhuvLHrQ4gVy1BmEZkPIRelTSvVRui6nVmc
paIz6KBuDbn7QyZxOsZggRUo+sTtJ9EJOflv45vOm+Yi2WuwSqLy0HJsdNq4ipCF
rdE05k6h4VYpQbuOI4OgNWElm9kwdCBdcrrOc1cRhuijooQ+agIBdQb4gImnDmWq
xuyvyNiTz/Lrl3QyKvSB
=3KFZ
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVu9e0n6ZAP0PgtI9AQIxBhAAuLb5Od/5uVucXfwL2t3PZzryF/hHiEPO
61J7dtl38wJsYWuZNLYGj+LOL3EbQMLe0tUl+T8LysvGUkvDeHesVUvi9CW9uQq5
6Rz4UIZXeDLMBMvSSTg4CaPBE5wzvDnJ5xjg8UkdLbdpudIbKl0XundvGkYIaESi
jgGXS8DZJmgdnYHH69SRAyEDEV7wG3ScOFv8nFETGoah6yDKvR4H+LJ/ey3icOBq
vl+p2oWHgdf7/TficKgj2DHso9wZDTEDCGwg2HAAB6GbTRL/j0ALsQOh+IqYpVyD
v8dCRJqPYiugccOnpYXBxf8EqfqD5CZXhgJwAyFn9kMQq8NkfFcBBOa1FfIi2TS9
zkXnsB+/n0RWUo6HapaRgeBaZXPmWNgOji0JlOmuzYFmMg4GQF8+W8r0prAmTpgB
2uEJgWs1tOoftDR9rtSRP9op3432CGK5198iBcc+BcH09jcyXx0YecEPMIgL+pxJ
TvbLfeNddPqviGiFPntLQRO7vec0GX+Wem4NVxMbxQIKQBDiMEiA7YSRqJw38xOJ
ki2d6kxa/6DAAonioowWkxtaWPaO1uQHTRtm9YUDbNt52zeZrBkCu4MUwsNOeHxf
0FHezc5VMjHW9u1FLtogd+JDyhfgGgcYFoP1/ddvCIOJyrLr9sJ3oqmxpZkS2oCY
xqdldQ6J4x8=
=4ctU
-----END PGP SIGNATURE-----