MGASA-2015-0268

Advisory lineage Upstream: 15 Downstream: 0
Published: 05 Jul 2015, 17:22
Last modified:16 Apr 2026, 06:25

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Jul 2015, 17:22
Published
Vulnerability first disclosed
16 Apr 2026, 06:25
Last Modified
Vulnerability information updated

Description

Updated firefox package fixes security vulnerability Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2015-2722, CVE-2015-2724, CVE-2015-2728, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740). A flaw was discovered in Mozilla's PDF.js PDF file viewer. When combined with another vulnerability, it could allow execution of arbitrary code with the privileges of the user running Firefox (CVE-2015-2743). A vulnerability in the TLS protocol allows a man-in-the-middle attacker to downgrade vulnerable TLS connections using ephemeral Diffie-Hellman key exchange to 512-bit export-grade cryptography. This vulnerability is known as Logjam (CVE-2015-4000). Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services (NSS) where the client allows for a ECDHE_ECDSA exchange where the server does not send its ServerKeyExchange message instead of aborting the handshake. Instead, the NSS client will take the EC key from the ECDSA certificate. This violates the TLS protocol and also has some security implications for forward secrecy. In this situation, the browser thinks it is engaged in an ECDHE exchange, but has been silently downgraded to a non-forward secret mixed-ECDH exchange instead. As a result, if False Start is enabled, the browser will start sending data encrypted under these non-forward-secret connection keys (CVE-2015-2721). Mozilla community member Watson Ladd reported that the implementation of Elliptical Curve Cryptography (ECC) multiplication for Elliptic Curve Digital Signature Algorithm (ECDSA) signature validation in Network Security Services (NSS) did not handle exceptional cases correctly. This could potentially allow for signature forgery (CVE-2015-2730). The nss package has been updated to version 3.19.2, which fixes issues related to the minimum key sizes of finite field algorithms, including CVE-2015-4000. It also fixes CVE-2015-2721 and CVE-2015-2730. The Mageia 4 sqlite3 package has also been updated to version 3.8.10.2, fixing an index corruption issue. Mageia 5 already shipped with version 3.8.10.2.

Affected Systems

  • mageia•firefox

    < 38.1.0-1.mga4

  • mageia•firefox-l10n

    < 38.1.0-1.mga4

  • mageia•nss

    < 3.19.2-1.mga4

  • mageia•sqlite3

    < 3.8.10.2-1.mga4

  • mageia•firefox

    < 38.1.0-1.mga5

  • mageia•firefox-l10n

    < 38.1.0-1.mga5

  • mageia•nss

    < 3.19.2-1.mga5

References (16)