{"id":"MGASA-2015-0025","summary":"Updated firefox and thunderbird packages fixes security vulnerabilities","details":"Several flaws were found in the processing of malformed web content. A web\npage containing malicious content could cause Firefox or Thunderbird to\ncrash or, potentially, execute arbitrary code with the privileges of the\nuser running it (CVE-2014-8634).\n\nIt was found that the Beacon interface implementation in Firefox and\nThunderbird did not follow the Cross-Origin Resource Sharing (CORS)\nspecification. A web page containing malicious content could allow a remote\nattacker to conduct a Cross-Site Request Forgery (XSRF) attack\n(CVE-2014-8638).\n\nIt was found that a Web Proxy returning a 407 Proxy Authentication response\nwith a Set-Cookie header could inject cookies into the originally requested\ndomain. This could be used for session-fixation attacks. This attack only\nallows cookies to be written but does not allow them to be read\n(CVE-2014-8639).\n\nSecurity researcher Mitchell Harper discovered a read-after-free in WebRTC\ndue to the way tracks are handled. This results in a either a potentially\nexploitable crash or incorrect WebRTC behavior. Note that this issue only\naffects Firefox (CVE-2014-8641).\n","modified":"2026-04-16T06:23:54.087145426Z","published":"2015-01-17T22:31:08Z","upstream":["CVE-2014-8634","CVE-2014-8638","CVE-2014-8639","CVE-2014-8641"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2015-0025.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=15040"},{"type":"ADVISORY","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-01/"},{"type":"ADVISORY","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-03/"},{"type":"ADVISORY","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-04/"},{"type":"ADVISORY","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2015-06/"},{"type":"WEB","url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/"},{"type":"WEB","url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2015-0046.html"},{"type":"WEB","url":"https://rhn.redhat.com/errata/RHSA-2015-0047.html"}],"affected":[{"package":{"name":"firefox","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/firefox?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.4.0-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0025.json"}},{"package":{"name":"firefox-l10n","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/firefox-l10n?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.4.0-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0025.json"}},{"package":{"name":"thunderbird","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/thunderbird?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.4.0-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0025.json"}},{"package":{"name":"thunderbird-l10n","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/thunderbird-l10n?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"31.4.0-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2015-0025.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}