Univention Bugzilla – Bug 49078
firefox-esr: Multiple issues (4.4)
Last modified: 2019-03-27 13:29:34 CET
New Debian firefox-esr 60.6.0esr-1~deb9u1 fixes: This update addresses the following issues: * Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506) * Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788) * Use-after-free when removing in-use DOM elements (CVE-2019-9790) * Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791) * IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792) * Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793) * Type-confusion in IonMonkey JIT compiler (CVE-2019-9795) * Use-after-free with SMIL animation controller (CVE-2019-9796) * IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810) * Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)
--- mirror/ftp/4.4/unmaintained/4.4-0/source/firefox-esr_60.5.1esr-1~deb9u1.dsc +++ apt/ucs_4.4-0-errata4.4-0/source/firefox-esr_60.6.0esr-1~deb9u1.dsc @@ -1,3 +1,15 @@ +60.6.0esr-1~deb9u1 [Wed, 20 Mar 2019 10:18:56 +0900] Mike Hommey <glandium@debian.org>: + + * New upstream release. + * Fixes for mfsa2019-08, also known as: + CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9793, + CVE-2019-9795, CVE-2019-9796, CVE-2018-18506, CVE-2019-9788. + + * debian/rules: Disable debug symbols on mips/mipsel on buster. + The rust compiler can't deal with them in the available address space. + * debian/browser.mozconfig.in: Adjust to the upstream change wrt Google + API key configure options. + 60.5.1esr-1~deb9u1 [Thu, 14 Feb 2019 18:35:06 +0900] Mike Hommey <glandium@debian.org>: * New upstream release. <http://10.200.17.11/4.4-0/#8743674669914561186>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-0] a7a2d282fc Bug #49078: firefox-esr 60.6.0esr-1~deb9u1 doc/errata/staging/firefox-esr.yaml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) [4.4-0] 0243210092 Bug #48326: Remove old errata YAML files doc/errata/staging/firefox-esr.yaml | 24 ------------------------ 1 file changed, 24 deletions(-) [4.4-0] 3bc818b281 Bug #48319: firefox-esr 60.4.0esr-1~deb9u1 doc/errata/staging/firefox-esr.yaml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) [4.4-0] cdd9b02396 Bug #48319: firefox-esr 60.4.0esr-1~deb9u1 doc/errata/staging/firefox-esr.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
<http://errata.software-univention.de/ucs/4.4/12.html>