Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.0775 firefox-esr security update 19 March 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: firefox-esr Publisher: Debian Operating System: Debian GNU/Linux 8 Debian GNU/Linux 9 Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Access Confidential Data -- Remote with User Interaction Resolution: Patch/Upgrade CVE Names: CVE-2018-5145 CVE-2018-5144 CVE-2018-5131 CVE-2018-5130 CVE-2018-5129 CVE-2018-5127 CVE-2018-5125 Reference: ASB-2018.0060 ASB-2018.0058 ASB-2018.0057.2 ESB-2018.0764 ESB-2018.0760 ESB-2018.0751 Original Bulletin: http://www.debian.org/security/2018/dsa-4139 http://www.debian.org/security/2018/dsa-4143 Comment: This bulletin contains two (2) Debian security advisories. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4139-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff March 15, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : firefox-esr CVE ID : CVE-2018-5125 CVE-2018-5127 CVE-2018-5129 CVE-2018-5130 CVE-2018-5131 CVE-2018-5144 CVE-2018-5145 Several security issues have been found in the Mozilla Firefox web browser: Multiple memory safety errors and other implementation errors may lead to the execution of arbitrary code, denial of service or information disclosure. For the oldstable distribution (jessie), these problems have been fixed in version 52.7.1esr-1~deb8u1. For the stable distribution (stretch), these problems have been fixed in version 52.7.1esr-1~deb9u1. We recommend that you upgrade your firefox-esr packages. For the detailed security status of firefox-esr please refer to its security tracker page at: https://security-tracker.debian.org/tracker/firefox-esr Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlqq5tcACgkQEMKTtsN8 TjZTvA//T+rqBCfHhIUEk8X0MkALkFtOKDTgSVYERg+ZUolCU0SgfBwIFNo6KbnQ a6FTAr2yHJeke7rNp1+NbHieJ1FcG7twkYlAI0/Ln4HRymIbgs8VYEVrI+hXCfbJ 8n69u5+iG2qwrNEgnlVLxSR5MoxoWLCa7LvZS2v6g37zFW4jbmf6iplh2lZMRpF0 RUYIVautPGPh+nT2yQCcZ//o0fvzywiqMenqcIqeVqS3abxcN6eOpmfo2uzASFoO 5L8/HotWTFGwGottm5Lg8aR+E6o2lfJSRIxzqqQW2cYB4sI9hczgeb5nyWg3z9ET tU9qEjzJo1zLeCaVPTulpRHH4HTMKDmE2CrH6OKTE1rLTiYeh7O8pS/GD/ZhZRhd W9INHgtp4G2IhwlAq8CBorGp+Qal8/0FZY6oVd7+Y0R8jQl0Dty1ArzC5lhEkkxS Ug72Y7QOy0okcdKbKKb4BvohV7kNuuGWhp/8mEMf4h3nVbGSMLJTKystDzjJL/Zi NEQFqHcW9aZZJ5xaVvpHNvhGwkvPGW6ckHi8RXKAHxRZRrIjhM2BtTiDOW0XmEo+ Jlcnd0kZmLkfXeN/JHTr62NdqJ2j0Gd3d0x8id+tDl2MbmnQk6hWp0ZW2dK1rnbG bzGm7wCHIGICtWq6Dx41N8BvlXkSPwq1DONt7Nxmmg3okpSB74c= =cCJ5 - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - - ------------------------------------------------------------------------- Debian Security Advisory DSA-4143-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff March 17, 2018 https://www.debian.org/security/faq - - ------------------------------------------------------------------------- Package : firefox-esr CVE ID : CVE-2018-5146 CVE-2018-5147 Richard Zhu and Huzaifa Sidhpurwala discovered that an out-of-bounds memory write when playing Vorbis media files could result in the execution of arbitrary code. For the oldstable distribution (jessie), these problems have been fixed in version 52.7.2esr-1~deb8u1. For the stable distribution (stretch), these problems have been fixed in version 52.7.2esr-1~deb9u1. We recommend that you upgrade your firefox-esr packages. For the detailed security status of firefox-esr please refer to its security tracker page at: https://security-tracker.debian.org/tracker/firefox-esr Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org - -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlqtWtMACgkQEMKTtsN8 TjbrTQ/+NVxmLOJJsLu6T9IlXAGL68mU6328aFhDuh/bcihr61JlE7se6QTqC3Nf 5OO892pZpVuvkBcn0ZCPBQ8fJiUHM/9HUzAKbQs0z23Fnhq0xlNkLTILHMhmWCLl U9pPYRuy3T+6rDd83fcqgLvDbn+gKalL1qYUn5tveVJx4l3fV9YTL2IAsKKzdFEo FXUojTKyMGQlPchCo9NfkbCrZ5DDQfmhHc5D0M/P3GeAi+emYSiivBSoG+4QSKJI kJjh0BCzgXzi3pm83ZzSlp9AcjNFqdWYWm86LIJJXL2Z0HPmIKY3f6ieZxhE9iDr f3jx4z+2n9DExPNPiZwsoS8bByR9Y0aipHKVo89UGvRSkvzxfoiX5pkZV3pvEx9v w2pE5OCW81lrVXRa1sEzbByOY9QTENtB8tvTONUT/4JOGdzo1FCXZ70mFzVGhxFx qU2NHkwOmRP2qCzVBsV+CLFVrvpmzt0PdeswI/x+j70BMXArGhsthiu5OBqyq+wZ K5v5VIWRFkLcnNFHQ0pCIs0EiGQ6HX6x8n4Sqa5OiOp7fKqp4+bENDLzFUYyC8So N1lw9l1/XG53G3MKbvSjOWkH1EkuSyb3LI///rW5rPMUxOdToFMOSADnfoIFm3Zt OY2krIrI4N2kaHHFkbJApMsseterse4ikZyVjOzcSh+Zi+mxRFA= =LNoL - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWq8IdIx+lLeg9Ub1AQgKGw/+Irkufd/TB9z58kjJepIG06XuL7GrdUqv xmmZQUnqtEF2aclLV3Ur/qUEekLPlyGwbKJzNy1J7ucGFVQ27TfBSKyBwBZ54Feo I/bCcKteQVkHcd/oV/RvBhRt+kJFwC+RddhiH2s3ChmiTrmOUcFOev4DvGqnE+kF y5noQFbuULR1Y4jktcWnlTrtE/64hZxhztuJ/oBd9HPsGK1kJS3YRoevPvtihKVH 0TGeYH3xCyseG/NOPFwmCp+oifWS0edXl2ln3JGIWFT4hzX/B4hVWW1lOT5Kmz7I GrpnZcOdb9ArQ9a91QgoG8v6driPfLtQw/lCMWospqKHm6qGcSAoDPBZLJARDV8w E3ixtcr/h9zY7qKNscZfLd4rHWYjPlFw+Lqd8hRqiu6AjTA4mIWIpJz4blp8Znt1 5CXQtTP9V40kYYdoZrnHQDXpyeBatglLkB5d4L6wBjDUcxxdJgz2AYpUl/tGsd64 aO6Z9pZTCYXpvoNrRJ+UYIwOMx5MIOPo1B1Rw+Of77IcI3BL11PmzpsKsxXZLLDZ 6D75h1/kziWNEp4+UWMm7SpsDBIUYgtQm23vHWy/7SsIA+J1B2lSqCXVmVUIUZEZ LEOxz/Z/mZQLb7zd5unEDTUGgbCgYU3u5t/G4nr7zDqWdoU+LBSi345HyuCMxcaM jp8TtMrLeT8= =EzzP -----END PGP SIGNATURE-----