Univention Bugzilla – Bug 49068
firefox-esr: Multiple issues (4.3)
Last modified: 2019-03-27 14:28:44 CET
New Debian firefox-esr 60.6.1esr-1~deb9u1 fixes: This update addresses the following issues: * Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506) * Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788) * Use-after-free when removing in-use DOM elements (CVE-2019-9790) * Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791) * IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792) * Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793) * Type-confusion in IonMonkey JIT compiler (CVE-2019-9795) * Use-after-free with SMIL animation controller (CVE-2019-9796) * IonMonkey MArraySlice has incorrect alias information (CVE-2019-9810) * Ionmonkey type confusion with __proto__ mutations (CVE-2019-9813)
--- mirror/ftp/4.3/unmaintained/component/4.3-3-errata/source/firefox-esr_60.5.1esr-1~deb9u1.dsc +++ apt/ucs_4.3-0-errata4.3-3/source/firefox-esr_60.6.1esr-1~deb9u1.dsc @@ -1,3 +1,21 @@ +60.6.1esr-1~deb9u1 [Sun, 24 Mar 2019 08:15:11 +0900] Mike Hommey <glandium@debian.org>: + + * New upstream release. + * Fixes for mfsa2019-10, also known as: + CVE-2019-9810, CVE-2019-9813. + +60.6.0esr-1~deb9u1 [Wed, 20 Mar 2019 10:18:56 +0900] Mike Hommey <glandium@debian.org>: + + * New upstream release. + * Fixes for mfsa2019-08, also known as: + CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9793, + CVE-2019-9795, CVE-2019-9796, CVE-2018-18506, CVE-2019-9788. + + * debian/rules: Disable debug symbols on mips/mipsel on buster. + The rust compiler can't deal with them in the available address space. + * debian/browser.mozconfig.in: Adjust to the upstream change wrt Google + API key configure options. + 60.5.1esr-1~deb9u1 [Thu, 14 Feb 2019 18:35:06 +0900] Mike Hommey <glandium@debian.org>: * New upstream release. <http://10.200.17.11/4.3-3/#215102746904895849>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.3-3] bd1b4fe595 Bug #49068: firefox-esr 60.6.1esr-1~deb9u1 doc/errata/staging/firefox-esr.yaml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
<http://errata.software-univention.de/ucs/4.3/460.html>