[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Unpatched security flaws in GNU IceCat 38

From: Mark H Weaver
Subject: Re: Unpatched security flaws in GNU IceCat 38
Date: Thu, 04 Aug 2016 03:29:59 -0400
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)

Hi Mike,

Mike Gerwitz <address@hidden> writes:

> On Wed, Aug 03, 2016 at 23:06:17 -0400, Mark H Weaver wrote:
>> I'm sorry to report that GNU IceCat 38 can no longer be safely used, due
>> to critical security flaws that are believed to allow remote code
>> execution.  I was unable to backport upstream fixes from 45.3 to 38.
>> Until IceCat 45.3 is available, I recommend that you use Epiphany.
> Could you elaborate?  I assume you're referencing this:

Drop the "#firefoxesr45.2" to see the fixes in 45.3 as well:

Upstream IceCat 38 is surely vulnerable to many of the flaws listed as
fixed in ESR 45.2 and 45.3.  The patched version of IceCat in GNU Guix
does not include fixes from 45.3, but includes my "best effort" attempt
to backport the most important fixes from ESR 45.2:

Although I felt sufficiently satisfied with the results to continue
using IceCat before the 45.3 fixes were announced, I must stress that I
am *not* familiar with the Mozilla code, and do not consider myself
competent to reliably backport these fixes across 7 major versions of
Firefox.  (Also note that my backported fixes do *not* include critical
fixes to the bundled copies of cairo and libvpx in IceCat, because in
Guix we delete those bundled copies.)

More specifically, I ran into difficulties attempting to backport the
following changesets from the upstream mozilla-esr45 mercurial repo:

[Critical] memory safety bugs (CVE-2016-2836):

  changeset:   312137:3a0deb9801ab
  user:        Jon Coppeard <address@hidden>
  Date:        Wed Jun 29 10:04:25 2016 +0100
  summary:     Bug 822081 - Allow barriers to fire while tracing the heap 
r=terrence a=abillings a=ritu

  changeset:   312162:1188098e26d5
  user:        Seth Fowler <address@hidden>
  Date:        Tue Jun 21 17:56:24 2016 -0700
  summary:     Bug 1249578 (Part 1) - Verify that the size in the BIH header 
matches the ICO directory entry instead of fixing it. r=njn a=abillings, 

[Critical] WebRTC - Use After Free in socket thread (CVE-2016-5258):

  changeset:   312151:cc258670af8f
  user:        Nils Ohlmeier [:drno] <address@hidden>
  Date:        Wed Jul 13 15:49:47 2016 -0700
  summary:     Bug 1279146 - Clean up streams on shutdown. r=bwc, a=lizzard

[Critical] Yet another Use After Free in CanonicalizeXPCOMParticipant

  changeset:   312145:380c05fc7d7f
  user:        Andrea Marchesini <address@hidden>
  Date:        Wed Jul 06 08:36:54 2016 +0200
  summary:     Bug 1282992 - Improve sync event loop shutdown in workers, 
r=khuey a=ritu

[High] Favicon request doesn't timeout, or close when related window is
closed (CVE-2016-2830):

  (mozilla bug 1255270; unable to find associated changeset)

[High] Heap-buffer-overflow in nsBidi::BracketData::AddOpening

  changeset:   312120:5ffdebd7418e
  user:        Jonathan Kew <address@hidden>
  Date:        Wed Jun 15 22:04:48 2016 +0100
  summary:     Bug 1279814 - Update mIsoRunLast index when handling PDI. 
r=xidorn, a=sylvestre

[High] stack-buffer-overflow in mozilla::gfx::BasePoint4d

  changeset:   312123:910b8f21e777
  user:        Carsten "Tomcat" Book <address@hidden>
  Date:        Thu Jun 23 12:41:04 2016 +0200
  summary:     Bug 1268854 - Break out of loop if no intersecting points on 
positive side of clipping plane. r=kip, a=sylvestre

[High] Type confusion in nsDisplayList::HitTest (CVE-2016-5263):

  (mozilla bug 1276897; unable to find associated changeset)

[Moderate] Heap-use-after-free in nsXULPopupManager::KeyDown

  (mozilla bug 1266963; unable to find associated changeset)

[Moderate] XSS out of iframe sandbox, iframe disabled
javascript. marquee (CVE-2016-5262):

  (mozilla bug 1277475; unable to find associated changeset)

[Moderate] Same origin policy bypass in local document/Universal xss

  changeset:   312157:3e8a4fa8cb04
  user:        Christoph Kerschbaumer <address@hidden>
  Date:        Wed Jun 22 17:15:06 2016 +0200
  summary:     Bug 1278013 - Remove SEC_FORCE_INHERIT_PRINCIPAL from loadinfo 
within baseChannel::Redirect. r=bz, a=sylvestre

> Are you going to be publishing an announcement about this?  Sorry if I
> missed it; doesn't mention anything.

I do not have access to modify  I raised an alarm on
the Gnuzilla development list at the time, but so far there has been no
developer response.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]