Bug 51083 - firefox-esr: Multiple issues (4.4)
firefox-esr: Multiple issues (4.4)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.4
All Linux
: P3 normal (vote)
: UCS 4.4-4-errata
Assigned To: Quality Assurance
Erik Damrose
:
: 51063 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-04-14 09:35 CEST by Quality Assurance
Modified: 2020-04-15 14:32 CEST (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2020-04-14 09:35:43 CEST
New Debian firefox-esr 68.7.0esr-1~deb9u1 fixes:
This update addresses the following issue(s):
* 
* Uninitialized memory could be read when using the WebGL copyTexSubImage method (CVE-2020-6821)
* Out of bounds write in GMPDecodeData when processing large images (CVE-2020-6822)
* Memory safety bugs fixed in Firefox 75 and Firefox ESR 68.7 (CVE-2020-6825)
Comment 1 Quality Assurance univentionstaff 2020-04-14 10:00:23 CEST
--- mirror/ftp/4.4/unmaintained/4.4-4/source/firefox-esr_68.6.0esr-1~deb9u1.dsc
+++ apt/ucs_4.4-0-errata4.4-4/source/firefox-esr_68.7.0esr-1~deb9u1.dsc
@@ -1,3 +1,14 @@
+68.7.0esr-1~deb9u1 [Wed, 08 Apr 2020 07:54:16 +0900] Mike Hommey <glandium@debian.org>:
+
+  * New upstream release
+  * Fixes for mfsa2020-13, also known as:
+    CVE-2020-6821, CVE-2020-6822, CVE-2020-6825.
+
+68.6.1esr-1~deb9u1 [Sat, 04 Apr 2020 06:41:17 +0900] Mike Hommey <glandium@debian.org>:
+
+  * New upstream release
+  * Fixes for mfsa2020-11, also known as: CVE-2020-6819, CVE-2020-6820.
+
 68.6.0esr-1~deb9u1 [Wed, 11 Mar 2020 06:59:57 +0900] Mike Hommey <glandium@debian.org>:
 
   * New upstream release

<http://10.200.17.11/4.4-4/#398697778226773965>
Comment 2 Erik Damrose univentionstaff 2020-04-14 13:22:29 CEST
*** Bug 51063 has been marked as a duplicate of this bug. ***
Comment 3 Erik Damrose univentionstaff 2020-04-14 17:28:09 CEST
OK: yaml
OK: announce_errata
OK: no patch
OK: piuparts
Comment 4 Erik Damrose univentionstaff 2020-04-15 14:32:15 CEST
<http://errata.software-univention.de/ucs/4.4/526.html>