Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2683
firefox-esr security update
10 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: firefox-esr
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-12378 CVE-2018-12377 CVE-2018-12376
Reference: ASB-2018.0207
ASB-2018.0206
ESB-2018.2660
ESB-2018.0300
Original Bulletin:
http://www.debian.org/security/2018/dsa-4287
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4287-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 07, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : firefox-esr
CVE ID : CVE-2018-12376 CVE-2018-12377 CVE-2018-12378
Several security issues have been found in the Mozilla Firefox web
browser: Multiple memory safety errors and use-after-frees may lead to
the execution of arbitrary code or denial of service.
Debian follows the extended support releases (ESR) of Firefox. Support
for the 52.x series has ended, so starting with this update we're now
following the 60.x releases.
Between 52.x and 60.x, Firefox has undergone significant internal
updates, which makes it incompatible with a number of extensions. For
more information please refer to
https://www.mozilla.org/en-US/firefox/60.0esr/releasenotes/
In addition, the new Firefox packages require Rust to build. A
compatible Rust toolchain has been backported to Debian stretch, but is
not available for all architectures which previously supported the
purely C++-based Firefox packages. Thus, the new Firefox packages
don't support the armel, armhf, mips, mips64el and mipsel architectures
at this point.
For the stable distribution (stretch), these problems have been fixed in
version 60.2.0esr-1~deb9u2.
We recommend that you upgrade your firefox-esr packages.
For the detailed security status of firefox-esr please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAluS6z0ACgkQEMKTtsN8
TjbGKA/7B7Nw05n5pLQdFrkmgEu9eNNP73am8F+W6wJda+fC8DzcscCnRfcbL/Wi
OThCiE402zBgK7sVgQWggfNj8BXl9TEzAk5od2AODWI2+swOjTzjecjpAKIilbKU
uzih1+t96GP2zW4Rhlw4XdtLDcKlRvRpo9TByFyPPidN+a/IgmbLj1WWUg5fX9b/
stskWiq02gLHUnxPFIK4ZBbKAn+WfinKeMvdsf76fgHlnRTxRYv1umXYT23gRO+R
cTRR4ivgNqz5yFu+IglAy9SyfUFoAJrEVsvjOtejNyW4KUfcE7q6V5aR4lrRnedQ
o3/VHw9167DlivjS+zs45O1y+nSijFRgimLP2W+0Frkv2tSXSU5wqgoWiv3mYHw0
UlMzQj3/B0G0ey3Oc0V82yRVF6XDB1JqmT0+IASoOmtPsNOmMs2lI6pSCsfm13Yv
oZ+3c4h02LARWtWe3JjvOTzXzUXC/812AjbofJGaS+MtShV/Mo1oRVpzmLW86L2/
okYA40E8P3YzTU5sVYN5DT7NU2q53HjzLWQSqIn814Yxt19IC5tTBLqbAjAbLJTg
DqUsh14GWNWf+pNxevqnSGYgxVQ14zsDtakkMtW//OTYNsuPjWqOmmE9+hVPOHnt
FJfk0bGd/Chj5QoiAcRA6Vfe4tdVy40Jk5MvEYX9zh3/nX1J8uA=
=DeML
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW5XpTGaOgq3Tt24GAQgEGA/9HGDLJA+9lSySfEGh5elfGdEV1swK8B+6
3aokL0cEN5KEDaopnwpyfI6iPphc4Zfzpr6AzTGTGxwOyLMYYgJcse0XDSR5Yv/n
ycyekLh1qQki144Yy2HIKjznmncaM9OWrtcrBtQcct2Dpr586+/kXV/4pRlq2Gdd
zSUAorPy5KQpoOOWVhpMKR6DlAesKFNBYcV0rn96zxgakbluW7fEdSvEXOrrmKLu
47YNL2M9Are/OwEdvUs6F9shvejD+ZvwrPm+QrFcJuz2MMf+kvinhbxTT1iySDIl
81YJBwm+MUKlFFOpudNBqc+I2rqMvGkcnV0vTYvfMHAUxsBdA2peFjN2PBegWuwz
h/0jfInwgHwLe+HH5qrUhu4QQpr4Ka4LvhjyKobbXhdDqs/qLhc0epxaexzA4/aG
KqGf0NJRtyzYoOoDEhBt68NgzMHDBZzkQdITgHzdN/0DcsaialiqMRhpziwNlCqc
VRSmMhUKGDECR6T0RS0dvm0g8xBppb+wUCk1a7FMtb2GJrnTxODwEvw//5rqxjdP
kvYcA/E9My/v+Bl7Ah9atr+AK3HAloTqF1hL+5H8VhdorSOG52AmPW5ac9rQRqoq
ZS+k1mm8z3ezVC5dsMF7odVFe9Ko51Amoaybbj8Tn/vPTOtvDvLZjt0zeh/HxCwN
i5z2dQF36gw=
=92lN
-----END PGP SIGNATURE-----