Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1904
firefox-esr patch comes to Debian 8
2 July 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: firefox-esr
Publisher: Debian
Operating System: Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-12366 CVE-2018-12365 CVE-2018-12364
CVE-2018-12363 CVE-2018-12362 CVE-2018-12360
CVE-2018-12359 CVE-2018-5188 CVE-2018-5156
Reference: ASB-2018.0140
ASB-2018.0139
ESB-2018.1894
ESB-2018.1884
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2018/06/msg00014.html
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Package : firefox-esr
Version : 52.9.0esr-1~deb8u1
CVE ID : CVE-2018-5156 CVE-2018-5188 CVE-2018-12359 CVE-2018-12360
CVE-2018-12362 CVE-2018-12363 CVE-2018-12364 CVE-2018-12365
CVE-2018-12366
Several security issues have been found in the Mozilla Firefox web
browser: Multiple memory safety errors and other implementation errors may
lead to the execution of arbitrary code, denial of service, cross-site
request forgery or information disclosure.
For Debian 8 "Jessie", these problems have been fixed in version
52.9.0esr-1~deb8u1.
We recommend that you upgrade your firefox-esr packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAls17SYACgkQnUbEiOQ2
gwISDhAAnvPGMSDRz7+1W9md2l2fSo09/wedwNt31VzC2c64Iagf8Di60O0MUvCY
P2KGsidjnl/EgeZj5Dp8ro/zwO0E24DORkHvRVMAyuSf057Bi2eNJEa8WJdJIxqs
Tt5zwo7XxfLzuYeSSAQKBflXc/fMOPBT1VrlJRmZ8sZzsFOm0ViFgYMEHil+TS3o
NfUVsWLnEiYTMLAwyHxF6Jq6KHnux1zQwEYZzkixvFy4+G7EQLIMLRLD1XTBHO1d
WdCVLYHRAD6TMiL1uiiBMy3TqL3pgOeq+pPMeU58zHcsAkmsOUzO5nxbeyJhwa+N
4uFIgrdhat4h8dWydYtBQD88TSM1BgjJZzD+uDd90jEf18n3kf1As0jqvtSp/PeK
EekBHt+YnI+n1aLM67mOWB6N9GeceRXqOvZfA/mL6c/LvM0kf0aNGvla8Morztxw
m0bWRGZ32UPtIZrYmuAEjknUWcym2WC7P3cbPbWSVak31xJdP4t6U0lTCWJifRuD
SWVPJP+i+u4vuOLSdwnroUKUcR0Dcp3GOh2rFM1U+BdOHh7d2kkuNwstdqlkV0Bf
hxBweGSFFXqWHH5ad8dflUQmZ0lRpONP6/Suvp3BSxFlpCeQe/2YfV60erT/zcO2
bKLvoLo6j24oS9/iXiWbaehqLoITpL1uaiE4tkd1YnhFnHVtEks=
=Junt
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWzlxaGaOgq3Tt24GAQgriRAA09KWzMZi78MFxpsnU/DIMCHe30u/e8wu
wLwfkq4lchBRcGBbyoZoHK+Y2oCVhSzCLJp7LEcee4WU3WxwpyP1UCtMo1TQ2OrU
mE6wyMbfJEwSRP1htXPJdlZ7FIwhZM5ZEhB4Rr4L93pWJOJfaGtmtbATuLgzDQQB
ZxPq3eUzsB49l2+XLlS5QAJMfpeDfwmc+fuxeGbJieMNOPnI7OXiw8JSqoniASFm
mxtuIIAlrVIp8AhsoQlr08y5c71pqy64gBVba8HFmT+5p6HqlYR5PowyNaXQPFgu
jx4l5Hu1+L07HQmx0H/NbxXb5AiAFIhwMxz0gm3EnwepYDMgCAITM6DrRY996bq5
Kn4nkQyPUHJUQHcxDifG31oEOXvCivfZkbdqRHeqm1H96EnsbORaRTKNNp+nJSTF
wcsq8yLdw/LHdBK7ehwVFQy/dLw3983hkB0kuVXYo5g8MX3jmSA5iAbuAIj+z1RO
TxSrEtKclYQBkgWkSOi5LWBErOdhnN9aRRjxr4G7UW8+Eea9GBvKfBCllCA31b33
hf3dsPhUPJADAQ/b/ySoYG+hf814KdBm10ooO1zZPArZizTbRQwpxTwJd3Y0hpX1
PdBDsLRog0sAkO9x6k+DciUKOufnduR+JzH6cudheGQ2pn2aVv4vuQ+tJKO4sIlr
OcftpWimayM=
=tk4e
-----END PGP SIGNATURE-----