CVE-2015-7202

These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.

MozillaFirefox was updated to version 38.5.0 esr to fix the following issues:

Following security issues were fixed:

• MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)
• MFSA 2015-138/CVE-2015-7210 Use-after-free in WebRTC when datachannel is used after being destroyed
• MFSA 2015-139/CVE-2015-7212 Integer overflow allocating extremely large textures
• MFSA 2015-145/CVE-2015-7205 Underflow through code inspection
• MFSA 2015-146/CVE-2015-7213 Integer overflow in MP4 playback in 64-bit versions
• MFSA 2015-147/CVE-2015-7222 Integer underflow and buffer overflow processing MP4 metadata in libstagefright
• MFSA 2015-149/CVE-2015-7214 Cross-site reading attack through data and view-source URIs

MozillaFirefox was updated to version 38.5.0 ESR to fix the following issues:

• MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)
• MFSA 2015-138/CVE-2015-7210 A use-after-free in WebRTC when datachannel is used after being destroyed
• MFSA 2015-139/CVE-2015-7212 An integer overflow allocating extremely large textures
• MFSA 2015-145/CVE-2015-7205 A underflow found through code inspection
• MFSA 2015-146/CVE-2015-7213 A integer overflow in MP4 playback in 64-bit versions
• MFSA 2015-147/CVE-2015-7222 Integer underflow and buffer overflow processing MP4 metadata in libstagefright
• MFSA 2015-149/CVE-2015-7214 Cross-site reading attack through data and view-source URIs

MozillaFirefox was updated to version 38.5.0 ESR.

It fixes the following security issues:

• MFSA 2015-134/CVE-2015-7201/CVE-2015-7202 Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)
• MFSA 2015-138/CVE-2015-7210 Use-after-free in WebRTC when datachannel is used after being destroyed
• MFSA 2015-139/CVE-2015-7212 Integer overflow allocating extremely large textures
• MFSA 2015-145/CVE-2015-7205 Underflow through code inspection
• MFSA 2015-146/CVE-2015-7213 Integer overflow in MP4 playback in 64-bit versions
• MFSA 2015-147/CVE-2015-7222 Integer underflow and buffer overflow processing MP4 metadata in libstagefright
• MFSA 2015-149/CVE-2015-7214 Cross-site reading attack through data and view-source URIs

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Andrei Vaida, Jesse Ruderman, Bob Clary, Christian Holler, Jesse Ruderman, Eric Rahm, Robert Kaiser, Harald Kirschner, and Michael Henretty discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7201, CVE-2015-7202)

Ronald Crane discovered three buffer overflows through code inspection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7203, CVE-2015-7220, CVE-2015-7221)

Cajus Pollmeier discovered a crash during javascript variable assignments in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7204)

Ronald Crane discovered a buffer overflow through code inspection. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7205)

It was discovered that it is possible to read cross-origin URLs following a redirect if performance.getEntries() is used with an iframe to host a page. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2015-7207)

It was discovered that Firefox allows for control characters to be set in cookies. An attacker could potentially exploit this to conduct cookie injection attacks on some web servers. (CVE-2015-7208)

Looben Yang discovered a use-after-free in WebRTC when closing channels in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7210)

Abdulrahman Alqabandi discovered that hash symbol is incorrectly handled when parsing data: URLs. An attacker could potentially exploit this to conduct URL spoofing attacks. (CVE-2015-7211)

Abhishek Arya discovered an integer overflow when allocating large textures. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7212)

Ronald Crane dicovered an integer overflow when processing MP4 format video in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-7213)

Tsubasa Iinuma discovered a way to bypass same-origin restrictions using data: and view-source: URLs. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information and read local files. (CVE-2015-7214)

Masato Kinugawa discovered a cross-origin information leak in error events in web workers. An attacker could potentially exploit this to obtain sensitive information. (CVE-2015-7215)

Gustavo Grieco discovered that the file chooser crashed on malformed images due to flaws in the Jasper library. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2015-7216, CVE-2015-7217)

Stuart Larsen discoverd two integer underflows when handling malformed…