ALT-BU-2014-3073-1
Branch sisyphus update bulletin.
Closed vulnerabilities
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
Package thunderbird updated to version 31.2.0-alt1 for branch sisyphus in task 133025.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2014-1587
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-83.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-83.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71391
- 71391
- https://bugzilla.mozilla.org/show_bug.cgi?id=1042567
- https://bugzilla.mozilla.org/show_bug.cgi?id=1042567
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072847
- https://bugzilla.mozilla.org/show_bug.cgi?id=1072847
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079729
- https://bugzilla.mozilla.org/show_bug.cgi?id=1079729
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080312
- https://bugzilla.mozilla.org/show_bug.cgi?id=1080312
- https://bugzilla.mozilla.org/show_bug.cgi?id=1089207
- https://bugzilla.mozilla.org/show_bug.cgi?id=1089207
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1590
The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-85.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-85.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71397
- 71397
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087633
- https://bugzilla.mozilla.org/show_bug.cgi?id=1087633
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1592
Use-after-free vulnerability in the nsHtml5TreeOperation function in xul.dll in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code by adding a second root element to an HTML5 document during parsing.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-87.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-87.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71398
- 71398
- https://bugzilla.mozilla.org/show_bug.cgi?id=1088635
- https://bugzilla.mozilla.org/show_bug.cgi?id=1088635
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1593
Stack-based buffer overflow in the mozilla::FileBlockCache::Read function in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to execute arbitrary code via crafted media content.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-88.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-88.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71395
- 71395
- https://bugzilla.mozilla.org/show_bug.cgi?id=1085175
- https://bugzilla.mozilla.org/show_bug.cgi?id=1085175
- GLSA-201504-01
- GLSA-201504-01
Modified: 2024-11-21
CVE-2014-1594
Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 might allow remote attackers to execute arbitrary code by leveraging an incorrect cast from the BasicThebesLayer data type to the BasicContainerLayer data type.
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:0138
- openSUSE-SU-2015:1266
- openSUSE-SU-2015:1266
- DSA-3090
- DSA-3090
- DSA-3092
- DSA-3092
- http://www.mozilla.org/security/announce/2014/mfsa2014-89.html
- http://www.mozilla.org/security/announce/2014/mfsa2014-89.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- 71396
- 71396
- https://bugzilla.mozilla.org/show_bug.cgi?id=1074280
- https://bugzilla.mozilla.org/show_bug.cgi?id=1074280
- GLSA-201504-01
- GLSA-201504-01
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
No data currently available.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2014-3694
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- http://hg.pidgin.im/pidgin/main/rev/2e4475087f04
- http://hg.pidgin.im/pidgin/main/rev/2e4475087f04
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1397
- openSUSE-SU-2014:1397
- http://pidgin.im/news/security/?id=86
- http://pidgin.im/news/security/?id=86
- 60741
- 60741
- 61968
- 61968
- DSA-3055
- DSA-3055
- USN-2390-1
- USN-2390-1
- RHSA-2017:1854
- RHSA-2017:1854
Modified: 2024-11-21
CVE-2014-3695
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.
- http://hg.pidgin.im/pidgin/main/rev/6436e14bdb9d
- http://hg.pidgin.im/pidgin/main/rev/6436e14bdb9d
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1397
- openSUSE-SU-2014:1397
- http://pidgin.im/news/security/?id=87
- http://pidgin.im/news/security/?id=87
- 60741
- 60741
- 61968
- 61968
- DSA-3055
- DSA-3055
- USN-2390-1
- USN-2390-1
- RHSA-2017:1854
- RHSA-2017:1854
Modified: 2024-11-21
CVE-2014-3696
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.
- http://hg.pidgin.im/pidgin/main/rev/44fd89158777
- http://hg.pidgin.im/pidgin/main/rev/44fd89158777
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1397
- openSUSE-SU-2014:1397
- http://pidgin.im/news/security/?id=88
- http://pidgin.im/news/security/?id=88
- 60741
- 60741
- 61968
- 61968
- DSA-3055
- DSA-3055
- USN-2390-1
- USN-2390-1
- RHSA-2017:1854
- RHSA-2017:1854
Modified: 2024-11-21
CVE-2014-3697
Absolute path traversal vulnerability in the untar_block function in win32/untar.c in Pidgin before 2.10.10 on Windows allows remote attackers to write to arbitrary files via a drive name in a tar archive of a smiley theme.
Modified: 2024-11-21
CVE-2014-3698
The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.
- http://hg.pidgin.im/pidgin/main/rev/ea46ab68f0dc
- http://hg.pidgin.im/pidgin/main/rev/ea46ab68f0dc
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1376
- openSUSE-SU-2014:1397
- openSUSE-SU-2014:1397
- http://pidgin.im/news/security/?id=90
- http://pidgin.im/news/security/?id=90
- 60741
- 60741
- 61968
- 61968
- DSA-3055
- DSA-3055
- USN-2390-1
- USN-2390-1
- RHSA-2017:1854
- RHSA-2017:1854