firefox-esr: Execute Arbitrary Code/Commands -- Remote with User Interaction

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0886
                        firefox-esr security update
                               28 March 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           firefox-esr
Publisher:         Debian
Operating System:  Debian GNU/Linux 7
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-5148  

Reference:         ASB-2018.0063
                   ESB-2018.0885

Original Bulletin: 
   https://lists.debian.org/debian-lts-announce/2018/03/msg00023.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Package        : firefox-esr
Version        : 52.7.3esr-1~deb7u1
CVE ID         : CVE-2018-5148

Jesse Schwartzentruber discovered a use-after-free vulnerability
in Firefox, which could be exploited to trigger an application
crash or arbitrary code execution.

For Debian 7 "Wheezy", these problems have been fixed in version
52.7.3esr-1~deb7u1.

We recommend that you upgrade your firefox-esr packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAlq6v8gACgkQnUbEiOQ2
gwIhhhAAyX+dEoE/2Q2P2EwOPOgJjl0t4Ud0KYwWywiB0vXV8K/xjDRJ0uTRNeOD
0tpypS9HukLvg3ATNCQLAVnmXr257/shkcVQDCR0OAfqSFv8+nPViKzavRF3EwAT
WVuCUCjwfbWPuZDBD58nzX0M9uRDdqYNDDGIu9LxXStut59g3G/r32vz/EPNdQHv
dzEH1UEA7Kjbp53gH5O9MAgOVJwpO8WrQvQsOkjCq1JD0djFRibPeqiypPrqllGF
/dTlEzI1vRtuLwqfaCEqswKEdWmcvokoZ0bmTg5VkmM/gy3pLFJRq6Snc5cb2eUf
CB1E7hgcgS2vAfNzUKUsipt/oG/FZ8oQ9tapjmmJ1krgjrxofArKnXYF2nOge7eU
FhZIBm98fUns4hRFpByEAW0Gnr6wLrKkoC2TBr/0sw9Kj6E2ycyzqiuVTqBo1Bz5
VNLv1O7T4wXt1bBLhNHi2U7pX+vMOvTD0ZcHoDU7xiYEnnxuqDjOMXhLncJEiIWv
uDXwzMrhHbZwa0k8ju2OF0ghSbaTH7SVSNoYbG1yAY8A7/QctfelvAnOnB6pmHej
otiKllFSNoi7UhsAvfZsjw33BTn1QRsFd8eZiiRlz+BRXrD6i1igwH/S7xGr1B2c
YGlOsQk8JdQrPfSgoK2rkmf2PwXPbm/U7ASQ1zJGumGAtcHzb1U=
=P4jI
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWrrfXYx+lLeg9Ub1AQhYbg/+NmWPQUJ8vOIGq3amE4CsVauE78f4lh4e
4t5VDMmyM+dfCu5ngZ0SXjtmWqOtse0pR6pQHMpomim5uFAYLDQXWKBzIVpJs2ZY
kE9TX9vnt65+nlqIPFI52GLMMBLbN6aM3ic8ey9QXjO2oX+FYNbdqM0ERiOYOY8I
Lzpb3NfgutZuaKIa3WynthOyilTiS3mUdlo2IbODzNA8uxX7rrpHRx9pp3s2kD6c
XGlSzQFQ5iMF97n8GwjSAgxzXdPpxiwj+tQHIuvIdbxADu8jfnKWralreVIhhqDv
ElIw+NgohCiWmrcL4J9i84Ng3C8Jltdndli2YJH+RUUn5ve1TpM4TiiBfWltzPde
Tk/XyHbEXxQJJ0T2f3UqK+/qgXSbrvEcz6PNGcAUyCAuCu/PtyDjV5yWJxE56qi4
5QFX2OHCN9/f6aPXV73wiJcx8Z6It0bKn6QzWuhrIAX8WHQX4iFVcuAHtsLxraOG
eOOoN/TB4qyAthsZQunnrwQpZsUYajxUPsjijp3pRAKOZcONrAdVH+BKXc9WBxK/
ALA+kiFkOaV8Lj+cra3QzacgSsDMfGXVSSkx/6bxJGkz25S3rUl59Nq9xFqzplWJ
zgROqSJn2B8WvaX9VWXXBlx6AdT6hAX/ODu4+5R1TwPV/ISSZLKZjNEl9XbdS0UR
HejAAe/TJSI=
=Ob/G
-----END PGP SIGNATURE-----