| Summary: | Firefox 45.5 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | davidwhodgins, mageia, sysadmin-bugs, tarazed25 |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/706580/ | ||
| Whiteboard: | MGA5-32-OK MGA5-64-OK advisory | ||
| Source RPM: | nspr, rootcerts, nss, firefox, firefox-l10n | CVE: | |
| Status comment: | |||
|
Description
David Walser
2016-11-15 16:49:08 CET
FYI it's built and upstream release notes are posted. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5250 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5257 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5261 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5270 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5272 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5274 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5276 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5277 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5278 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5280 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5281 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5284 https://www.mozilla.org/en-US/security/advisories/mfsa2016-86/ https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ lib64nspr4-4.13.1-1.mga5 lib64nspr-devel-4.13.1-1.mga5 rootcerts-20160922.00-1.mga5 rootcerts-java-20160922.00-1.mga5 nss-3.27.1-1.mga5 nss-doc-3.27.1-1.mga5 lib64nss3-3.27.1-1.mga5 lib64nss-devel-3.27.1-1.mga5 lib64nss-static-devel-3.27.1-1.mga5 noarch packages: firefox-en_GB-45.5.0-1.mga5 firefox-uk-45.5.0-1.mga5 firefox-en_ZA-45.5.0-1.mga5 firefox-45.5.0-1.mga5 Installed and running on x86_64. CC:
(none) =>
tarazed25 RedHat has issued an advisory for this today (November 16): https://rhn.redhat.com/errata/RHSA-2016-2780.html The references in Comment 1 were wrong, they should be: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5290 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5291 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5296 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5297 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9064 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9066 https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/ https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ I believe the nss update also fixed CVE-2016-9074 from the MFSA referenced above. Advisory: ======================== Updated nss and firefox packages fix security vulnerabilities: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291, CVE-2016-5290). A flaw was found in the way Add-on update process was handled by Firefox. A Man-in-the-Middle attacker could use this flaw to install a malicious signed add-on update (CVE-2016-9064). An existing mitigation of timing side-channel attacks in NSS before 3.26.1 is insufficient in some circumstances (CVE-2016-9074). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5290 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5291 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5296 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5297 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9064 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9066 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9074 https://www.mozilla.org/en-US/security/advisories/mfsa2016-90/ https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ https://rhn.redhat.com/errata/RHSA-2016-2780.html Working fine on my x86_64 workstation at work and my i586 laptop. I even managed to get Pidgin working on my laptop again, though the rootcerts don't appear to have been the real issue. I had to copy the certs in ~/.purple/certificates/x509/tls_peers/ from a computer where it was working (which fixed AIM) and set the Connect server to talk.google.com for my Google Talk account. Whiteboard:
(none) =>
MGA5-32-OK MGA5-64-OK
David Walser
2016-11-16 19:26:45 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/706580/
Dave Hodgins
2016-11-16 21:26:45 CET
Keywords:
(none) =>
validated_update can you fix firefox-l10n version in the advisory ? thanks CC:
(none) =>
mageia An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0379.html Status:
NEW =>
RESOLVED LWN reference for CVE-2016-9074: http://lwn.net/Vulnerabilities/706734/ |