Christian Holler and Patrick McManus reported memory safety problems and
crashes that affect Firefox ESR 31.3 and Firefox 34.
Christoph Diehl, Christian Holler, Gary Kwong, Jesse Ruderman, Byron
Campen, Terrence Cole, and Nils Ohlmeier reported memory safety problems
and crashes that affect Firefox 34.
Security researcher Muneaki Nishimura reported that
navigator.sendBeacon() does not follow the cross-origin resource sharing
(CORS) specification. This results in the request from sendBeacon()
lacking an origin header in violation of the W3C Beacon specification
and not being treated as a CORS request. This allows for a potential
Cross-site request forgery (XSRF) attack from malicious websites.
Security researcher Xiaofeng Zheng of the Blue Lotus Team at Tsinghua
University reported reported that a Web Proxy returning a 407 Proxy
Authentication response with a Set-Cookie header could inject cookies
into the originally requested domain. This could be used for
session-fixation attacks. This attack only allows cookies to be written
but does not allow them to be read.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
any | any | any | thunderbird | < 31.4.0-1 | UNKNOWN |