Test ID:	1.3.6.1.4.1.25623.1.0.131106
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2015-0414)
Summary:	The remote host is missing an update for the 'iceape, sqlite3' package(s) announced via the MGASA-2015-0414 advisory.
Description:	Summary: The remote host is missing an update for the 'iceape, sqlite3' package(s) announced via the MGASA-2015-0414 advisory. Vulnerability Insight: Updated iceape packages fix security issues. The sqlite3 package has been updated as well since the new iceape version requires the SQLITE_ENABLE_DBSTAT_VTAB feature to be enabled in sqlite. This sqlite3 update also enables ICU support, fixing bug #16814 . Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API. (CVE-2015-4477) Mozilla Firefox before 40.0 allows man-in-the-middle attackers to bypass a mixed-content protection mechanism via a feed: URL in a POST request. (CVE-2015-4483) The nsCSPHostSrc::permits function in dom/security/nsCSPUtils.cpp in Mozilla Firefox before 40.0 does not implement the Content Security Policy Level 2 exceptions for the blob, data, and filesystem URL schemes during wildcard source-expression matching, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging unexpected policy-enforcement behavior. (CVE-2015-4490) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-4500) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-4501) The lut_inverse_interp16 function in the QCMS library in Mozilla Firefox before 41.0 allows remote attackers to obtain sensitive information or cause a denial of service (buffer over-read and application crash) via crafted attributes in the ICC 4 profile of an image. (CVE-2015-4504) The SavedStacks class in the JavaScript implementation in Mozilla Firefox before 41.0, when the Debugger API is enabled, allows remote attackers to cause a denial of service (getSlotRef assertion failure and application exit) or possibly execute arbitrary code via a crafted web site. (CVE-2015-4507) Mozilla Firefox before 41.0, when reader mode is enabled, allows remote attackers to spoof the relationship between address-bar URLs and web content via a crafted web site. (CVE-2015-4508) Race condition in the WorkerPrivate::NotifyFeatures function in Mozilla Firefox before 41.0 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) by leveraging improper interaction between shared workers and the IndexedDB implementation. (CVE-2015-4510) Heap-based buffer overflow in the nestegg_track_codec_data function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 allows remote attackers to execute arbitrary code via a crafted header in a WebM ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'iceape, sqlite3' package(s) on Mageia 5. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-4477 https://security.gentoo.org/glsa/201605-06 http://www.securitytracker.com/id/1033247 SuSE Security Announcement: openSUSE-SU-2015:1389 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00014.html SuSE Security Announcement: openSUSE-SU-2015:1390 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00015.html SuSE Security Announcement: openSUSE-SU-2016:0876 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00089.html SuSE Security Announcement: openSUSE-SU-2016:0894 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00091.html http://www.ubuntu.com/usn/USN-2702-1 http://www.ubuntu.com/usn/USN-2702-2 http://www.ubuntu.com/usn/USN-2702-3 Common Vulnerability Exposure (CVE) ID: CVE-2015-4483 BugTraq ID: 76510 http://www.securityfocus.com/bid/76510 Common Vulnerability Exposure (CVE) ID: CVE-2015-4490 Common Vulnerability Exposure (CVE) ID: CVE-2015-4500 BugTraq ID: 76816 http://www.securityfocus.com/bid/76816 Debian Security Information: DSA-3365 (Google Search) http://www.debian.org/security/2015/dsa-3365 RedHat Security Advisories: RHSA-2015:1834 http://rhn.redhat.com/errata/RHSA-2015-1834.html RedHat Security Advisories: RHSA-2015:1852 http://rhn.redhat.com/errata/RHSA-2015-1852.html http://www.securitytracker.com/id/1033640 SuSE Security Announcement: SUSE-SU-2015:1680 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00004.html SuSE Security Announcement: SUSE-SU-2015:1703 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00007.html SuSE Security Announcement: SUSE-SU-2015:2081 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00025.html SuSE Security Announcement: openSUSE-SU-2015:1658 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00000.html SuSE Security Announcement: openSUSE-SU-2015:1679 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00003.html SuSE Security Announcement: openSUSE-SU-2015:1681 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00005.html http://www.ubuntu.com/usn/USN-2743-1 http://www.ubuntu.com/usn/USN-2743-2 http://www.ubuntu.com/usn/USN-2743-3 http://www.ubuntu.com/usn/USN-2743-4 http://www.ubuntu.com/usn/USN-2754-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-4501 Common Vulnerability Exposure (CVE) ID: CVE-2015-4502 BugTraq ID: 76815 http://www.securityfocus.com/bid/76815 Common Vulnerability Exposure (CVE) ID: CVE-2015-4504 Common Vulnerability Exposure (CVE) ID: CVE-2015-4507 Common Vulnerability Exposure (CVE) ID: CVE-2015-4508 Common Vulnerability Exposure (CVE) ID: CVE-2015-4509 http://www.zerodayinitiative.com/advisories/ZDI-15-646 Common Vulnerability Exposure (CVE) ID: CVE-2015-4510 Common Vulnerability Exposure (CVE) ID: CVE-2015-4511 Common Vulnerability Exposure (CVE) ID: CVE-2015-4512 Common Vulnerability Exposure (CVE) ID: CVE-2015-4516 Common Vulnerability Exposure (CVE) ID: CVE-2015-4517 Common Vulnerability Exposure (CVE) ID: CVE-2015-4519 Common Vulnerability Exposure (CVE) ID: CVE-2015-4520 Common Vulnerability Exposure (CVE) ID: CVE-2015-4521 Common Vulnerability Exposure (CVE) ID: CVE-2015-4522 Common Vulnerability Exposure (CVE) ID: CVE-2015-7174 Common Vulnerability Exposure (CVE) ID: CVE-2015-7175 Common Vulnerability Exposure (CVE) ID: CVE-2015-7176 Common Vulnerability Exposure (CVE) ID: CVE-2015-7177
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.