Univention Bugzilla – Bug 49073
firefox-esr: Multiple issues (4.2)
Last modified: 2019-03-27 16:44:50 CET
New Debian firefox-esr 60.6.0esr-1~deb8u1 fixes: This update addresses the following issues: * Proxy Auto-Configuration file can define localhost access to be proxied (CVE-2018-18506) * Memory safety bugs fixed in Firefox 66 and Firefox ESR 60.6 (CVE-2019-9788) * Use-after-free when removing in-use DOM elements (CVE-2019-9790) * Type inference is incorrect for constructors entered through on-stack replacement with IonMonkey (CVE-2019-9791) * IonMonkey leaks JS_OPTIMIZED_OUT magic value to script (CVE-2019-9792) * Improper bounds checks when Spectre mitigations are disabled (CVE-2019-9793) * Type-confusion in IonMonkey JIT compiler (CVE-2019-9795) * Use-after-free with SMIL animation controller (CVE-2019-9796)
--- mirror/ftp/4.2/unmaintained/component/4.2-5-errata/source/firefox-esr_60.5.1esr-1~deb8u1.dsc +++ apt/ucs_4.2-0-errata4.2-5/source/firefox-esr_60.6.0esr-1~deb8u1.dsc @@ -1,10 +1,22 @@ -60.5.1esr-1~deb8u1 [Thu, 14 Feb 2019 12:22:56 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: +60.6.0esr-1~deb8u1 [Wed, 20 Mar 2019 11:00:19 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: - * Non-maintainer upload by the LTS team. + * Non-maintainer upload by the LTS Team. * Backport to jessie. * Pick arm-unknown-linux-gnueabi as rust target on armel. armv4t and armv5te don't have the standard library available on jessie. * Build against the embedded jsoncpp, jessie's one is too old. + +60.6.0esr-1 [Wed, 20 Mar 2019 10:18:56 +0900] Mike Hommey <glandium@debian.org>: + + * New upstream release. + * Fixes for mfsa2019-08, also known as: + CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9793, + CVE-2019-9795, CVE-2019-9796, CVE-2018-18506, CVE-2019-9788. + + * debian/rules: Disable debug symbols on mips/mipsel on buster. + The rust compiler can't deal with them in the available address space. + * debian/browser.mozconfig.in: Adjust to the upstream change wrt Google + API key configure options. 60.5.1esr-1 [Thu, 14 Feb 2019 18:35:06 +0900] Mike Hommey <glandium@debian.org>: <http://10.200.17.11/4.2-5/#8646393830921767161>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.2-5] 1fd89c855d Bug #49073: firefox-esr 60.6.0esr-1~deb8u1 doc/errata/staging/firefox-esr.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
--- mirror/ftp/4.2/unmaintained/component/4.2-5-errata/source/firefox-esr_60.5.1esr-1~deb8u1.dsc +++ apt/ucs_4.2-0-errata4.2-5/source/firefox-esr_60.6.1esr-1~deb8u1.dsc @@ -1,10 +1,28 @@ -60.5.1esr-1~deb8u1 [Thu, 14 Feb 2019 12:22:56 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: +60.6.1esr-1~deb8u1 [Mon, 25 Mar 2019 10:01:47 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: - * Non-maintainer upload by the LTS team. + * Non-maintainer upload by the LTS Team. * Backport to jessie. * Pick arm-unknown-linux-gnueabi as rust target on armel. armv4t and armv5te don't have the standard library available on jessie. * Build against the embedded jsoncpp, jessie's one is too old. + +60.6.1esr-1 [Sun, 24 Mar 2019 08:15:11 +0900] Mike Hommey <glandium@debian.org>: + + * New upstream release. + * Fixes for mfsa2019-10, also known as: + CVE-2019-9810, CVE-2019-9813. + +60.6.0esr-1 [Wed, 20 Mar 2019 10:18:56 +0900] Mike Hommey <glandium@debian.org>: + + * New upstream release. + * Fixes for mfsa2019-08, also known as: + CVE-2019-9790, CVE-2019-9791, CVE-2019-9792, CVE-2019-9793, + CVE-2019-9795, CVE-2019-9796, CVE-2018-18506, CVE-2019-9788. + + * debian/rules: Disable debug symbols on mips/mipsel on buster. + The rust compiler can't deal with them in the available address space. + * debian/browser.mozconfig.in: Adjust to the upstream change wrt Google + API key configure options. 60.5.1esr-1 [Thu, 14 Feb 2019 18:35:06 +0900] Mike Hommey <glandium@debian.org>: <http://10.200.17.11/4.2-5/#8347543251268100882>
*** Bug 49095 has been marked as a duplicate of this bug. ***
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.2-5] 00214db21a Bug #49073: firefox-esr 60.6.1esr-1~deb8u1 doc/errata/staging/firefox-esr.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [4.2-5] b520fac132 Bug #49073: firefox-esr 60.6.1esr-1~deb8u1 doc/errata/staging/firefox-esr.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) [4.2-5] 1fd89c855d Bug #49073: firefox-esr 60.6.0esr-1~deb8u1 doc/errata/staging/firefox-esr.yaml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
<http://errata.software-univention.de/ucs/4.2/617.html>